SC-500 AI security objectives: what the 11 objectives cover and where each one lives

The short answer

SC-500’s Secure compute domain opens with a subgroup called Implement security for AI. It has 11 objectives, and they don’t live in one product. Following them takes you through eight admin surfaces: the SharePoint admin center, the Microsoft Purview portal, the Power Platform admin center, the Microsoft Entra admin center, the Microsoft Defender portal, the Azure portal, the Foundry portal and the Microsoft 365 admin center (SC-500 study guide, and the pages linked in the table below).

AZ-500 had nothing comparable; the whole subgroup is new (AZ-500 study guide). And several of the features are still in preview, which matters because the study guide says commonly used preview features may appear (SC-500 study guide).

The 11 objectives at a glance

The objectives are paraphrased here; the study guide has Microsoft’s wording. “Status” is what the Microsoft Learn page says about the feature on October 20, 2026.

#	What the objective covers	Where you work	Status
1	Finding SharePoint content shared more widely than it should be, before Copilot surfaces it	SharePoint admin center, Reports, Data access governance (reports)	No preview label
2	Finding Copilot and AI app risks with Purview Data Security Posture Management	Microsoft Purview portal, DSPM (DSPM)	No preview label; the older DSPM for AI is now called “classic”
3	Real-time protection for Copilot Studio agents	Power Platform admin center, Security, Threat detection (Copilot Studio); Defender portal for the rules (real-time protection)	Preview
4	Conditional Access for Entra Agent ID	Entra admin center, Conditional Access (secure autonomous agents)	Agent ID generally available (what’s new); agent users preview (targeting agents)
5	Blast radius of risks tied to agent identities, in Defender XDR	Defender portal: Assets, AI agents (inventory); attack paths and choke points (Exposure Management)	Agent threat detection preview (agent threats)
6	Managing what Entra Agent ID identities can access	Entra admin center, ID Governance, access packages (access packages for agents)	No preview label
7	The AI gateway in API Management in front of Foundry	Foundry portal, Manage, AI Gateway (Foundry), or API Management policies (AI gateway)	API Management labels the Foundry integration preview
8	Defender for AI Services, a workload protection plan	Azure portal, Defender for Cloud, Environment settings, Defender plans (enable)	Generally available (AI threat protection)
9	Guardrails for agents in Foundry	Foundry portal (guardrails)	Agent guardrails preview
10	The Data and AI security dashboard	Defender for Cloud (dashboard)	No preview label
11	Managing agents in the Microsoft 365 admin center	Microsoft 365 admin center, Agents (manage agents)	No preview label

Read the table by layer and a shape appears. Objectives 1 and 2 protect the data an AI can reach. Objectives 4, 5 and 6 cover the identities agents run as. Objectives 3 and 9 sit inside the agent’s own loop, and objective 7 at the model’s front door. Objectives 8 and 10 detect and report, and objective 11 is the inventory that ties them together.

Details that change the answer

A few facts from these pages decide between options that otherwise look equally right.

• Two SharePoint controls, two effects. Restricted access control blocks users outside the chosen groups, even if they had permission or a sharing link before (restricted access control). Restricted Content Discovery hides a site from organization-wide search and Copilot but doesn’t change permissions; people with access can still open the content directly (Restricted Content Discovery).
• DSPM starts small. The default data risk assessment runs weekly over the top 100 SharePoint sites by usage (data risk assessments).
• Defender’s default rule only audits. For agent real-time protection, the built-in Default rule audits all agents; blocking takes a custom rule (real-time protection). On the Copilot Studio side, external threat detection is set per environment, with no tenant-wide switch (Copilot Studio).
• Conditional Access targets the token subject. When an agent acts on behalf of a signed-in user, the policy must target users and groups, not the agent identity. Conditional Access doesn’t apply when security defaults are on, or to resources an agent reaches with an API key (Conditional Access for agents).
• An agent’s guardrail replaces its model’s. In Foundry, the agent guardrail fully overrides the guardrail of the model underneath (guardrails). Prompt Shields detect user prompt attacks by default; detection of attacks hidden in documents is off until you turn it on (Prompt Shields).
• “AI gateway” means two things. The AI gateway is a set of API Management capabilities (AI gateway). The AI Gateway tier is a separate API Management tier, in public preview (AI Gateway tier).
• Deleting an agent is reversible for 30 days. In the Microsoft 365 admin center, a deleted agent can be restored within a 30-day recovery window (agent actions).

Licensing moved this year

Since July 1, 2026, the AI agent security capabilities for Copilot Studio and Foundry agents in Microsoft Defender require a Microsoft Agent 365 license. Defender for Cloud Apps and Defender for Cloud licenses no longer cover them (transition to Agent 365). Study material written before that date can be wrong on this point. Conditional Access for agents also depends on Agent 365: it needs Microsoft 365 E7, which includes Agent 365, or Agent 365 with at least Entra ID P1 or Microsoft 365 E3 (Conditional Access for agents).

Where to learn it

Microsoft’s free learning path for this subgroup, Implement security for AI, has 9 modules and lists 3 hours 59 minutes (learning path). It teaches the products. Chapter 3 of our SC-500 study guide takes each of the 11 objectives with its portal path, license gate and preview status, and tests them with practice questions where every option is explained.