Preparing for the MS-500 Microsoft 365 Security Administration Exam (February 2020 Update)

MS-500 Cert I’ve recently been talking to quite a few people who need to take this exam, and while the original preparation guide posted just over a year ago is still mostly accurate, there have been some changes in the exam objectives that needed to be addressed. Below you will find the current as of time of posting exam objectives, along with resources that should help you prepare.

This exam now includes performance based testing, so make sure you aren’t just strong on theory but also know how to navigate the various portals. I still think that if you have already passed MS-100, MS-101, MD-100 and MD-101 this exam shouldn’t be too difficult if you focus on filling in the differences.

Implement and manage identity and access (30-35%)

Secure Microsoft 365 hybrid environments
- Configure and manage security integration components in Microsoft 365 hybrid environments including connectivity, synchronization services, and authentication
  - Determine identity requirements
- Plan Azure AD authentication options
  - Azure Active Directory deployment plans
- Plan Azure AD synchronization options
  - Hybrid Identity Design Considerations Overview
- Monitor and interpret Azure AD Connect events
  - Azure AD Connect Health Operations
Secure user accounts
- Implement Azure AD dynamic group membership
  - Create a dynamic group
- Implement Azure AD Self-service password reset
  - Deploy self-service password reset
- Manage Azure AD access reviews
  - Manage user access with access reviews
Implement authentication methods
- Plan sign-on security
  - Determine multi-factor auth requirements
- Implement multi-factor authentication (MFA)
  - How it works: Azure Multi-Factor Authentication
- Manage and monitor MFA
  - MFA Reports
- Implement device sign-on methods
  - User and device settings
- Manage authentication methods
  - Authentication methods
- Monitor authentication methods
  - What are Azure AD reports?
Implement conditional access
- Plan for compliance and conditional access policies
  - Common ways to use conditional access
- Configure and manage device compliance policy
  - Create a device compliance policy
- Configure and manage conditional access policy
  - Create and assign conditional access policy
- Monitor Conditional Access and Device Compliance
  - Monitor conditional access
Implement role-based access control (RBAC)
- Plan for RBAC
  - What is RBAC?
- Configure RBAC
  - Portal
  - PowerShell
- Monitor RBAC usage
  - View activity logs
Implement Azure AD Privileged Identity Management (PIM)
- Plan for Azure PIM
  - What is Azure AD PIM?
- Configure and manage Azure PIM
  - Start using PIM
- Monitor Azure PIM
  - View audit history
Implement Azure AD Identity Protection
- Implement user risk policy
  - Configure the user risk policy
- Implement sign-in risk policy
  - Configure the sign-in risk policy
- Configure Identity Protection alerts
  - Close active risk events
- Review and respond to risk events
  - Simulate risk events

Implement and manage threat protection (20-25%)

Implement an enterprise hybrid threat protection solution
- Plan an Azure Advanced Threat Protection (ATP) solution
  - Create your Azure ATP instance
- Install and configure Azure ATP
  - Configure the Azure ATP sensor
- Manage Azure ATP workspace health
  - Work with Azure ATP health center
- Generate Azure ATP reports
  - Reports
- Integrate Azure ATP with Windows Defender ATP
  - Integrate with Windows Defender ATP
- Monitor Azure ATP
  - Monitored activities
- Manage suspicious activities
  - Understanding security alerts
Implement device threat protection
- Plan and implement a Microsoft Defender ATP solution
  - Get started
- Manage Microsoft Defender ATP
  - Configure and manage capabilities
- Monitor Microsoft Defender ATP
  - Enable and configure always-on protection and monitoring
Implement and manage device and application protection
- Plan for device protection
  - Windows 10
- Configure and manage Windows Defender Application Guard
  - Windows Defender Application Guard
- Configure and manage Windows Defender Application Control
  - Windows Defender Application Control design guide
- Configure and manage Windows Defender Exploit Guard
  - Windows Defender Exploit Guard
- Configure Secure Boot
  - Secure the Windows 10 boot process
- Configure and manage Windows 10 device encryption
  - BitLocker
- Configure and manage non-Windows device encryption
  - Use app protection policies
- Plan for securing applications data on devices
  - Determine requirements
- Define managed apps for Mobile Application Management (MAM)
  - Prevent data leaks on non-managed devices
- Protect your enterprise data using Windows Information Protection (WIP)
  - Protect your enterprise data using Windows Information Protection (WIP)
- Configure Intune App Protection policies for Windows and non-Windows devices
  - Configure Windows Information Protection settings
  - Create app protection policies
Implement and manage Office 365 ATP
- Configure Office 365 ATP anti-phishing protection
  - Anti-phishing protection in Office 365
- Configure Office 365 ATP anti-phishing policies
  - Set up anti-phishing and ATP anti-phishing policies
- Define users and domains to protect with Office 365 ATP Anti-phishing
  - Learn about ATP anti-phishing policy options
- Configure Office 365 ATP anti-spoofing
  - Anti-spoofing protection in Office 365
- Configure actions against impersonation
  - Set up anti-phishing and ATP anti-phishing policies
- Configure Office 365 ATP anti-spam protection
  - Review the prerequisites
- Enable Office 365 ATP Safe-Attachments
  - Set up ATP Safe Attachments policies
- Configure Office 365 ATP Safe Attachments policies
  - Set up (or edit) an ATP Safe Attachments policy
- Configure Office 365 ATP Safe Attachments options
  - Learn about ATP Safe Attachments policy options
- Configure Office 365 ATP Safe Links options
  - Review the prerequisites
- Configure Office 365 ATP Safe Links blocked URLs
  - Set up a custom blocked URLs list
- Configure Office 365 ATP Safe Links policies
  - Set up ATP Safe Links policies
Implement and manage Office 365 threat protection
- Configure Office 365 Threat Intelligence
  - Get started with Office 365 Threat Intelligence
- Integrate Office 365 Threat Intelligence with Office 365 services
  - Turn on ATP for SharePoint, OneDrive, and Microsoft Teams
- Integrate Office 365 Threat Intelligence with Windows Defender ATP
  - Integrate Office 365 Threat Intelligence with Windows Defender Advanced Threat Protection
- Review threats and malware trends on the Office 365 ATP Threat Management dashboard
  - View reports for Office 365 Advanced Threat Protection
- Review threats and malware trends with Office 365 ATP Threat Explorer and Threat Tracker
  - Threat Trackers – New and Noteworthy
- Create and review Office 365 ATP incidents
  - How to view and use threat management in the Security & Compliance Center
- Review quarantined items in ATP including Microsoft SharePoint Online, OneDrive for Business, Exchange Online, and Microsoft Teams
  - Manage quarantined messages and files as an administrator
- Monitor online anti-malware solutions using Office 365 ATP reports
  - View ATP reports
- Perform tests using Attack Simulator
  - Attack Simulator in Office 365