4.4. Reflection Checkpoint

Key Takeaways

• AI security introduces three genuinely new risk categories — oversharing, agent identity/blast radius, and behavioral manipulation — none of which map cleanly onto pre-existing AZ-500 concepts.
• The AI Gateway (traffic governance), Foundry guardrails (content/behavior filtering), and Defender for AI Service (detection) are three distinct layers that address different parts of the AI security problem, not interchangeable options.
• VM security layers by when they apply: encryption/secure boot at rest and boot time, JIT/Bastion at access time, Arc extending reach to hybrid/multicloud, Defender for Servers and agentless scanning continuously, and Machine Configuration against ongoing drift.
• Agentless scanning provides broad, fast visibility but not real-time protection — it complements rather than replaces agent-based EDR.
• Container and serverless security narrows what you're responsible for (platform-managed infrastructure) but not how carefully you apply identity, network, and configuration discipline within that narrower scope.

Connecting Forward

Phase 5 shifts from securing individual compute and AI workloads to managing security posture and monitoring across the entire environment — Defender for Cloud's CSPM capabilities, Microsoft Sentinel's detection and response, and Security Copilot's investigation acceleration. Many controls introduced in this phase (Defender for Servers, Defender for Containers, Defender for AI Service) are workload protection plans that all report up into the posture and monitoring layer covered next.

Self-Check Questions

• Why does Entra Agent ID's blast radius analysis matter even when an agent's individually-granted permissions look reasonable and well-scoped?
• If you had to explain why "the WAF is enabled, so we're covered" is an incomplete answer, which Phase 1 principle would you point back to?