SC-500 decision sheets

• PIM eligible vs active vs permanent, and where scope and activation controls live
• Always Encrypted vs TDE vs dynamic data masking vs row-level security vs Ledger
• VM and backup disk encryption: SSE with CMK vs PMK vs ADE vs encryption at host
• Workload identity types: app object vs service principal vs managed identity