Don’t Map Controls to Azure. Build the Pipeline That Proves Them.
Certified GRC Engineer, Azure Specialty (CGE-AZ)
Most enterprise GRC teams live in Microsoft shops. Almost all cloud GRC training starts with AWS. The CGE-AZ ends the translation era: six labs, one automated GRC pipeline, running in your own subscription by the time you submit the capstone.
Introducing the CGE-AZ
Certified GRC Engineer, Azure Specialty
Most tooling reports findings. The pipeline you build in this course reports them and fixes them: it discovers what’s running, activates what’s missing, collects once into an evidence store you own, generates the SAR, POA&M, and OSCAL SSP with every number traceable to a stored record, and remediates violations through an identity you can audit. About 110 minutes of bite-sized video — the learning happens in the labs.
7
Domains
~110 min
Bite-sized video
6
Hands-on labs
Yes
Graded capstone
One Course. One Build.
Six pipeline stages, each built in a lab, assembled in the capstone.
1
Discovery
Detect what runs
2
Activation
Enable what’s missing
3
Evidence Store
Cosmos + WORM Blob
4
Reporting
SAR · POA&M · OSCAL
5
Narrative
AI describes, never decides
6
Enforcement
Human-approved fixes
Then the loop closes: remediation is reflected in the next collection. Automated, continuous, defensible, self-correcting.
What You'll Learn
Seven domains. The first three make you fluent; the next three build the pipeline; the last one ships it.
Azure Foundations: Speaking the Language
Tenant, management groups, subscriptions, resource groups. Entra ID, the two role systems, control vs. data plane, and the managed identities the whole pipeline runs on.
The Azure GRC Toolkit
The six services that run the pipeline — Defender for Cloud, Azure Policy, Log Analytics + KQL, Functions, Cosmos DB, Blob Storage — each mapped to its AWS counterpart.
Terraform on Azure
The azurerm delta from CGE-P: provider auth with zero stored secrets (az login, OIDC, managed identity), remote state without S3, and governance as code behind pull requests.
The Evidence Plane
Pipeline stages 1–3: discovery-first Terraform, conditional Defender + CSF 2.0 activation, and an evidence store you own — Cosmos DB, WORM-immutable Blob, collector Functions.
Reporting & the Narrative Layer
SAR, POA&M, and OSCAL SSP generated from the store only, so every number has a receipt. Plus the AI weekly digest, with one hard rule: AI describes, never decides.
Enforcement & Pipeline Operations
Azure Policy auto-remediation through a least-privilege identity, the audit → dry-run → enforce ladder, the OPA gate on the repo, and drift detection in both directions.
Capstone: Ship Your Pipeline
The graded capstone is the pipeline itself, deployed as code in your subscription from your repo, scored against a published rubric you can read from day one.
The Assessment
A knowledge exam plus a required, graded capstone. You need both.
Certification Exam
- 50questions: 40 multiple choice + 10 scenario-based on real artifacts
- 75 minutes to complete
- 70%passing score (35/50) · 14-day retake wait
Domain Weights
The Capstone: Required
Your capstone is the pipeline itself — foundations, evidence plane, at least two live reports, and enforcement in dry-run — deployed as code in your own subscription and submitted as a public GitHub repo. Six labs build it piece by piece; if you do the labs, the capstone is assembly, not invention.
- ✓Graded against a published rubric — read it from day one
- ✓Five dimensions: IaC, controls & identity, evidence integrity, operations, documentation
- ✓Two attempts, 24-hour cooldown, written feedback either way
Stacked on CGE-P
A ladder, not a lateral. CGE-P is a hard prerequisite.
CGE-P · The Discipline
Terraform, policy-as-code, CI/CD, evidence automation, and a graded capstone. The CGE-AZ re-teaches none of it — which is why it fits in 110 minutes of video.
Start with the CGE-PCGE-AZ · The Azure Delta
Everything Azure does differently — the hierarchy, the two role systems, the first-party policy engine AWS never shipped — plus the pipeline build. The first cloud specialty in the family, and the template for the AWS and GCP specialties that follow.
Keeping Your Cert Active
Annual renewal, same as every CGE credential.
Club Members
Stay active as a GRC Engineering Club member and your CGE-AZ renews automatically each year. No extra steps, no logging hours.
- ✓Automatic renewal with active membership
- ✓No CPE tracking required
- ✓Ongoing access to new courses and content
Non-Members
If you’re not an active club member, maintain your certification with continuing professional education hours each renewal year.
- •CPE hours logged in the Academy’s built-in tracker
- •Club events, published writing, or open-source GRC tooling
- •Mentorship of new CGE candidates
Why CGE-AZ?
Most tooling reports findings. This pipeline reports them — and fixes them.
Labs Carry the Course
Twenty-five lessons averaging under five minutes, then 10+ hours of hands-on work. Every lab was validated end to end on a fresh Azure free account before launch.
You Ship a Pipeline
Not a service tour. By the capstone, a six-stage GRC pipeline runs in your own subscription: discover, activate, store, report, narrate, enforce.
Stacked on CGE-P
No re-teaching Terraform, Git, or control theory. CGE-P is a hard prerequisite, and the course spends every minute on the Azure delta.
Evidence With Receipts
WORM-immutable storage, zero stored credentials, and reports that read from the evidence store only — every number traces to a timestamped record.
CGE-AZ FAQ
Everything you need to know about the Azure Specialty.
What is the CGE-AZ?
The CGE-AZ (Certified GRC Engineer, Azure Specialty) is the first cloud specialty in the CGE family. It takes a CGE-P holder and teaches them to engineer compliance on Azure by building one thing across six labs: an automated GRC engineering pipeline that discovers what is running, activates what is missing, collects evidence into a store they own, generates the SAR, POA&M, and OSCAL SSP, and remediates violations through a least-privilege identity.
Who is the CGE-AZ for?
GRC engineers, compliance engineers, security engineers, and cloud-savvy auditors who hold CGE-P and work in, or are moving into, Microsoft shops. Most enterprise GRC teams live in Entra ID, Defender for Cloud, and Microsoft 365, while almost all cloud GRC training starts with AWS. The CGE-AZ ends the translation era.
Do I need CGE-P first?
Yes. CGE-P is a hard prerequisite, enforced at enrollment: the course assumes you can write Terraform, use Git and pull requests, and explain a control objective, because CGE-P taught you all three. No Microsoft certification is required, and you do not need prior Azure experience.
What does the CGE-AZ exam cover?
Fifty questions, 40 multiple choice plus 10 scenario-based, in 75 minutes, with a 70% pass score (35/50). Scenario questions put real artifacts in front of you: a policy definition, a KQL query, a Terraform plan, a pipeline log. Domains are weighted: Azure Foundations (15%), The Azure GRC Toolkit (15%), Terraform on Azure (15%), The Evidence Plane (20%), Reporting & Narrative (15%), Enforcement & Operations (10%), Capstone (10%).
What is the CGE-AZ capstone?
The capstone is required, and it is the pipeline itself: deployed as code in your own Azure subscription, submitted as a public GitHub repo, and graded pass/fail against a published rubric — five dimensions covering IaC quality, control implementation and identity design, evidence integrity, pipeline operations, and documentation. You get two attempts with a 24-hour cooldown.
What does the course cost to take, including the Azure labs?
The CGE-AZ is free for active GRC Engineering Club members. Non-members can purchase access for $350, one-time, including the video training, labs, exam, and certificate. The labs run in your own Azure subscription at effectively zero cost: a fresh free account includes a $200 credit and spending protection, the one paid Defender plan the course uses runs inside its 30-day free trial, and every lab ships a teardown script.
When does the CGE-AZ launch?
The CGE-AZ drops September 18, 2026 on the GRC Engineering Club Training Academy. The lab repo, study guide, exam blueprint, and capstone rubric are published so you can prepare from day one.
CGE-P Gave You the Discipline.
CGE-AZ Makes You Dangerous in Microsoft Shops.
Drops September 18, 2026. Join the Club to take it free as a member, and start the pre-reads today.
Free for Club members and beta participants. Or buy a cert directly:
Full refund within 14 days if you have not started the course. By purchasing you agree to our Terms and Refund Policy.