Study Guide: MS-500 – Microsoft 365 Security Administration

Having recently passed the MS-500, I wanted to share my study guide and the resources I used to help get me over the line for this certification. Once you pass the MS-500 exam you will earn the Microsoft 365 Certified: Security Administrator Associate certification, demonstrating that you are able to proactively secure Microsoft 365 enterprise environments, responds to threats, performs investigations, and enforces data governance.

With any Microsoft Exam the content changes on a regular basis, so it is always best to ensure you keep updated with the latest guidance from Microsoft. This can usually be found on the Exam page. In terms of the MS-500 exam the skills measured are broken down into the following categories and weighted as such:

• Implement and manage identity and access (30-35%)
• Implement and manage threat protection (20-25%)
• Implement and manage information protection (15-20%)
• Manage governance and compliance features in Microsoft 365 (25-30%)

It’s worth noting that by default, most of the questions cover features that are General Availability (GA), however, the exam may contain questions on Preview features if those features are commonly used.

Microsoft Learn Resources

By default, I always try to use the Microsoft Learn resources. If you aren’t aware of Microsoft Learn, it is a training platform built and maintained by Microsoft and is completely free of charge. Microsoft Learn provides a vast amount of online training and learning paths for a range of Microsoft technologies, the training is delivered through videos, reading materials, and labs, but also has quizzes at the end of sections, so that you can gauge your knowledge. By default, my first point is always to check the Microsoft Learn materials.

• Protect identity and access with Azure Active Directory (6 Modules)
• Defend against threats with Microsoft 365 (4 Modules)
• Protect enterprise information with Microsoft 365 (5 Modules)
• Manage security with Microsoft 365 (4 Modules)
• Manage insider risk in Microsoft 365 (5 Modules)

Microsoft Docs Resources

On top of the Microsoft Learn resources, is Microsoft Docs, again this is another free Microsoft Resource. I have created a list of resources based on the Skills measured exam document:

Implement and manage identity and access (30-35%)

Secure Microsoft 365 hybrid environments

• Plan Azure AD authentication options
  • Authentication for Azure AD hybrid identity solutions – Active Directory | Microsoft Docs
  • Authentication methods and features – Azure Active Directory | Microsoft Docs
  • What is hybrid identity with Azure Active Directory? | Microsoft Docs
  • Identity requirements for hybrid cloud identity design Azure | Microsoft Docs
• Plan Azure AD synchronization options
  • Azure AD Connect sync: Understand and customize synchronization | Microsoft Docs
  • Azure AD Connect: Getting Started using express settings | Microsoft Docs
  • Customize an installation of Azure Active Directory Connect | Microsoft Docs
  • Hybrid identity and directory synchronization for Microsoft 365 – Microsoft 365 Enterprise | Microsoft Docs
  • Azure Active Directory hybrid identity design considerations – overview | Microsoft Docs
  • Deploy Microsoft 365 Directory Synchronization in Microsoft Azure – Microsoft 365 Enterprise | Microsoft Docs
  • How synchronization works in Azure AD Domain Services | Microsoft Docs
  • Set up directory synchronization for Microsoft 365 – Microsoft 365 Enterprise | Microsoft Docs
• Monitor and troubleshoot Azure AD Connect events
  • Azure AD Connect: Troubleshoot Azure AD connectivity issues | Microsoft Docs
  • Azure AD Connect: Troubleshoot object synchronization | Microsoft Docs
  • What is Azure AD Connect and Connect Health. | Microsoft Docs
  • Azure Active Directory Connect Health operations | Microsoft Docs

Secure Identities

• Implement Azure AD group membership
  • Create a basic group and add members – Azure Active Directory | Microsoft Docs
  • Create or edit a dynamic group and get status – Azure AD | Microsoft Docs
  • Rules for dynamically populated groups membership – Azure AD | Microsoft Docs
  • Validate rules for dynamic group membership (preview) – Azure AD | Microsoft Docs
• Implement password management
  • Deployment considerations for Azure Active Directory self-service password reset | Microsoft Docs
  • Enable Azure Active Directory self-service password reset | Microsoft Docs
  • Let users reset their own passwords – Microsoft 365 admin | Microsoft Docs
  • Self-service password reset deep dive – Azure Active Directory | Microsoft Docs
  • Self-service password reset policies – Azure Active Directory | Microsoft Docs
• Configure and manage identity governance
  • Identity Governance – Azure Active Directory | Microsoft Docs
  • Manage user access with access reviews – Azure AD | Microsoft Docs
  • What is entitlement management? – Azure AD | Microsoft Docs

Implement authentication methods

• Plan sign-on security
  • Azure Active Directory security defaults | Microsoft Docs
  • What is Azure single sign-on (SSO)? | Microsoft Docs
  • Hybrid identity design – multi-factor authentication requirements Azure | Microsoft Docs
• Implement multi-factor authentication (MFA)
  • Azure AD Multi-Factor Authentication for your organization – Azure Active Directory | Microsoft Docs
  • Set up multifactor authentication for users – Microsoft 365 admin | Microsoft Docs
  • Enable Azure AD Multi-Factor Authentication | Microsoft Docs
  • Azure AD Multi-Factor Authentication versions and consumption plans | Microsoft Docs
• Manage and monitor MFA
  • Manage authentication methods for Azure AD Multi-Factor Authentication – Azure Active Directory | Microsoft Docs
  • Sign-in event details for Azure AD Multi-Factor Authentication – Azure Active Directory | Microsoft Docs
  • Change your two-factor verification method and settings – Azure Active Directory | Microsoft Docs
  • Azure Security Center’s security recommendations for MFA | Microsoft Docs
• Plan and implement device authentication methods like Windows Hello
  • Plan a passwordless authentication deployment in Azure Active Directory | Microsoft Docs
  • Planning a Windows Hello for Business Deployment – Microsoft 365 Security | Microsoft Docs
  • Move away from passwords, deploy Windows Hello. Today! | Microsoft Security Blog
  • Passwordless Strategy – Microsoft 365 Security | Microsoft Docs
  • Passwordless security key sign-in – Azure Active Directory | Microsoft Docs
• Configure and manage Azure AD user authentication options and self-service password management
  • Authentication methods and features – Azure Active Directory | Microsoft Docs
  • Plan a passwordless authentication deployment in Azure Active Directory | Microsoft Docs
  • Self-service password reset for Windows devices – Azure Active Directory | Microsoft Docs

Implement conditional access

• Plan for compliance and conditional access policies
  • Plan an Azure Active Directory Conditional Access Deployment | Microsoft Docs
  • Conditional Access scenarios – Microsoft Intune | Microsoft Docs
  • Conditions in Conditional Access policy – Azure Active Directory | Microsoft Docs
  • Building a Conditional Access policy – Azure Active Directory | Microsoft Docs
  • What is Conditional Access in Azure Active Directory? | Microsoft Docs
• Configure and manage device compliance for endpoint security
  • Manage endpoint security in Microsoft Intune | Microsoft Docs
  • Device compliance policies in Microsoft Intune | Microsoft Docs
  • Manage devices with endpoint security in Microsoft Intune | Microsoft Docs
  • Create device compliance policies in Microsoft Intune | Microsoft Docs
  • Conditional Access – Require compliant devices – Azure Active Directory | Microsoft Docs
• Implement and manage conditional access
  • Common Conditional Access policies – Azure Active Directory | Microsoft Docs
  • Conditional Access – Block legacy authentication – Azure Active Directory | Microsoft Docs
  • Conditional Access – Require MFA for administrators – Azure Active Directory | Microsoft Docs
  • Sign-in risk-based Conditional Access – Azure Active Directory | Microsoft Docs
  • User risk-based Conditional Access – Azure Active Directory | Microsoft Docs
  • Conditional Access – Block access by location – Azure Active Directory | Microsoft Docs
  • Troubleshooting sign-in problems with Conditional Access – Azure Active Directory | Microsoft Docs
  • Troubleshoot Conditional Access using the What If tool – Azure Active Directory | Microsoft Docs

Implement role-based access control (RBAC)

• Plan for roles
  • What is Azure role-based access control (Azure RBAC)? | Microsoft Docs
  • Best practices for Azure RBAC | Microsoft Docs
  • Classic subscription administrator roles, Azure roles, and Azure AD roles | Microsoft Docs
  • Overview of Azure Active Directory role-based access control (RBAC) | Microsoft Docs
  • Understand Azure Active Directory role concepts | Microsoft Docs
  • Best practices for Azure AD roles – Azure Active Directory | Microsoft Docs
  • Secure access practices for administrators in Azure AD | Microsoft Docs
  • Delegate roles by admin task – Azure Active Directory | Microsoft Docs
• Configure roles
  • Create or update Azure custom roles using the Azure portal – Azure RBAC | Microsoft Docs
  • Assign Azure roles using the Azure portal – Azure RBAC | Microsoft Docs
  • Assign Azure roles using Azure PowerShell – Azure RBAC | Microsoft Docs
  • Azure built-in roles – Azure RBAC | Microsoft Docs
  • Azure custom roles – Azure RBAC | Microsoft Docs
  • Azure AD built-in roles – Azure Active Directory | Microsoft Docs
  • Assign Azure AD roles to users – Azure Active Directory | Microsoft Docs
  • Create a group for assigning roles in Azure Active Directory | Microsoft Docs
  • Create custom roles in Azure AD role-based access control | Microsoft Docs
• Audit roles
  • View activity logs for Azure RBAC changes | Microsoft Docs
  • Troubleshoot Azure AD roles assigned to groups – Azure Active Directory | Microsoft Docs
  • List Azure AD role assignments | Microsoft Docs

Implement Azure AD Privileged Identity Management (PIM)

• Plan for Azure PIM
  • Plan a Privileged Identity Management deployment? – Azure AD | Microsoft Docs
  • What is Privileged Identity Management? – Azure AD | Microsoft Docs
  • Secure access practices for administrators in Azure AD | Microsoft Docs
  • Start using PIM – Azure Active Directory | Microsoft Docs
• Assign eligibility and activate admin roles
  • Configure Azure AD role settings in PIM – Azure AD | Microsoft Docs
  • Configure Azure resource role settings in PIM – Azure AD | Microsoft Docs
  • Activate my Azure AD roles in PIM – Azure Active Directory | Microsoft Docs
  • Activate Azure resource roles in PIM – Azure AD | Microsoft Docs
  • Assign Azure AD roles in PIM – Azure Active Directory | Microsoft Docs
  • Assign Azure resource roles in Privileged Identity Management – Azure Active Directory | Microsoft Docs
• Manage Azure PIM role requests and assignments
  • Approve or deny requests for Azure AD roles in PIM – Azure AD | Microsoft Docs
  • Approve requests for Azure resource roles in PIM – Azure AD | Microsoft Docs
  • Approve activation requests for group members and owners in Privileged Identity Management – Azure AD | Microsoft Docs
  • Discover Azure resources to manage in PIM – Azure AD | Microsoft Docs
  • Identify a group to manage in Privileged Identity Management – Azure AD | Microsoft Docs
  • Configure Azure AD role settings in PIM – Azure AD | Microsoft Docs
• Monitor PIM history and alert
  • Create an access review of Azure AD roles in PIM – Azure AD | Microsoft Docs
  • Create an access review of Azure resource roles in PIM – Azure AD | Microsoft Docs
  • Troubleshoot resource access denied in Privileged Identity Management – Azure Active Directory | Microsoft Docs
  • Security alerts for Azure AD roles in PIM – Azure AD | Microsoft Docs
  • Configure security alerts for Azure resource roles in Privileged Identity Management – Azure Active Directory | Microsoft Docs
  • View audit log report for Azure AD roles in Azure AD PIM | Microsoft Docs
  • View audit report for Azure resource roles in Privileged Identity Management (PIM) – Azure AD | Microsoft Docs
  • Azure AD roles Discovery and insights (preview) in Privileged Identity Management former Security Wizard – Azure Active Directory | Microsoft Docs

Implement Azure AD Identity Protection

• Implement user risk policy
  • Risk policies – Azure Active Directory Identity Protection | Microsoft Docs
  • Azure AD Identity Protection policies | Microsoft Docs
  • Risk-based user sign-in protection in Azure Active Directory | Microsoft Docs
  • Remediate risks and unblock users in Azure AD Identity Protection | Microsoft Docs
• Implement sign-in risk policy
  • Risk policies – Azure Active Directory Identity Protection | Microsoft Docs
  • Sign-in risk-based Conditional Access – Azure Active Directory | Microsoft Docs
• Configure Identity Protection alerts
  • Risk policies – Azure Active Directory Identity Protection | Microsoft Docs
  • What is Azure Active Directory Identity Protection? | Microsoft Docs
  • Azure Active Directory Identity Protection notifications | Microsoft Docs
• Review and respond to risk events
  • Investigate risk Azure Active Directory Identity Protection | Microsoft Docs
  • Remediate risks and unblock users in Azure AD Identity Protection | Microsoft Docs
  • Microsoft Graph PowerShell SDK and Azure Active Directory Identity Protection | Microsoft Docs

Implement and manage threat protection (20-25%)

Implement an enterprise hybrid threat protection solution

• Plan a Microsoft Defender for Identity solution
  • What is Microsoft Defender for Identity? | Microsoft Docs
  • Microsoft Defender for Identity documentation | Microsoft Docs
  • Microsoft Defender for Identity prerequisites | Microsoft Docs
  • Microsoft Defender for Identity architecture | Microsoft Docs
  • Planning your Microsoft Defender for Identity deployment | Microsoft Docs
• Install and configure Microsoft Defender for Identity
  • Create your Microsoft Defender for Identity instance quickstart | Microsoft Docs
  • Connect Microsoft Defender for Identity to Active Directory quickstart | Microsoft Docs
  • Download the Microsoft Defender for Identity sensor setup package quickstart | Microsoft Docs
  • Install Microsoft Defender for Identity sensor quickstart | Microsoft Docs
• Monitor and manage Microsoft Defender for Identity
  • Understanding the Microsoft Defender for Identity portal | Microsoft Docs
  • Monitor Microsoft Defender for Identity System Health and Events | Microsoft Docs
  • Understanding Microsoft Defender for Identity health alerts | Microsoft Docs
  • Monitoring domain controllers and installed sensors installed on your domain controllers using Microsoft Defender for Identity | Microsoft Docs
  • Working with security alerts in Microsoft Defender for Identity | Microsoft Docs
  • Manage sensitive or honeytoken accounts with Microsoft Defender for Identity | Microsoft Docs

Implement device threat protection

• Plan a Microsoft Defender for Endpoint solution
  • Microsoft Defender for Endpoint documentation | Microsoft Docs
  • Microsoft Defender for Endpoint | Microsoft Docs
  • Prepare Microsoft Defender for Endpoint deployment | Microsoft Docs
  • Minimum requirements for Microsoft Defender for Endpoint | Microsoft Docs
  • Plan your Microsoft Defender for Endpoint deployment | Microsoft Docs
• Implement Microsoft Defender for Endpoint
  • Set up Microsoft Defender for Endpoint deployment | Microsoft Docs
  • Configure advanced features in Microsoft Defender for Endpoint | Microsoft Docs
• Manage and monitor Microsoft Defender For Endpoint
  • Manage Microsoft Defender for Endpoint alerts | Microsoft Docs
  • Check the Microsoft Defender for Endpoint service health | Microsoft Docs
  • Overview of endpoint detection and response capabilities | Microsoft Docs

Implement and manage device and application protection

• Plan for device and application protection
  • App protection policies overview – Microsoft Intune | Microsoft Docs
  • Device features and settings in Microsoft Intune | Microsoft Docs
  • Create and deploy app protection policies – Microsoft Intune | Microsoft Docs
  • Configure device settings | Microsoft Docs
• Configure and manage Microsoft Defender Application Guard
  • Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs
  • Manage Application Guard policies – Configuration Manager | Microsoft Docs
  • Configure the Group Policy settings for Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs
  • System requirements for Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs
  • Testing scenarios with Microsoft Defender Application Guard (Windows 10) – Windows security | Microsoft Docs
• Configure and manage Microsoft Defender Application Control
  • Application Control for Windows – Windows security | Microsoft Docs
  • Windows Defender Application Control and virtualization-based code integrity (Windows 10) – Windows security | Microsoft Docs
  • Deploy WDAC policies via Group Policy (Windows 10) – Windows security | Microsoft Docs
  • How to manage Windows Defender Application Control – Configuration Manager | Microsoft Docs
  • Deploy WDAC policies using Mobile Device Management (MDM) (Windows 10) – Windows security | Microsoft Docs
  • Manage packaged apps with WDAC (Windows 10) – Windows security | Microsoft Docs
• Configure and manage exploit protection
  • Windows Defender Exploit Guard policy – Configuration Manager | Microsoft Docs
  • Apply mitigations to help prevent attacks through vulnerabilities | Microsoft Docs
  • Turn on exploit protection to help mitigate against attacks | Microsoft Docs
• Configure Secure Boot
  • Secure boot | Microsoft Docs
  • Secure the Windows 10 boot process – Microsoft 365 Security | Microsoft Docs
• Configure and manage Windows device encryption
  • Overview of BitLocker Device Encryption in Windows 10 – Microsoft 365 Security | Microsoft Docs
  • BitLocker (Windows 10) – Microsoft 365 Security | Microsoft Docs
• Configure and manage non-Windows device encryption
  • Encrypt your Android device – Microsoft Intune | Microsoft Docs
  • Encrypt macOS devices with FileVault disk encryption with Intune – Microsoft Intune | Microsoft Docs
  • Encryption report for encrypted devices in Microsoft Intune – Microsoft Intune | Microsoft Docs
• Plan for securing applications data on devices
  • Protect your data in files, apps, and devices | Microsoft Security Blog
  • Prevent data leaks on non-managed devices – Microsoft Intune | Microsoft Docs
  • Planning guide to move to Microsoft Intune | Microsoft Docs
• Implement application protection policies
  • App protection policies overview – Microsoft Intune | Microsoft Docs
  • Frequently asked questions about MAM and app protection | Microsoft Docs
  • Data protection framework using app protection policies – Microsoft Intune | Microsoft Docs
  • Android app protection policy settings – Microsoft Intune | Microsoft Docs
  • App protection policies and Android Enterprise personally-owned work profiles in Microsoft Intune | Microsoft Docs

Implement and manage Microsoft Defender for Office 365

• Configure Microsoft Defender for Office 365
  • Microsoft 365 Defender | Microsoft Docs
  • Office 365 Security including Microsoft Defender for Office 365 and Exchange Online Protection – Office 365 | Microsoft Docs
  • Set up Safe Attachments policies in Microsoft Defender for Office 365 – Office 365 | Microsoft Docs
  • Set up Safe Links policies in Microsoft Defender for Office 365 – Office 365 | Microsoft Docs
  • Microsoft recommendations for EOP and Defender for Office 365 security settings – Office 365 | Microsoft Docs
  • Anti-phishing protection – Office 365 | Microsoft Docs
• Monitor Microsoft Defender for Office 365
  • Security dashboard overview – Office 365 | Microsoft Docs
  • Security Incident Response – Office 365 | Microsoft Docs
  • Mail flow insights in the Mail flow dashboard – Office 365 | Microsoft Docs
• Conduct simulated attacks using Attack Simulator
  • Attack Simulator in the Security & Compliance Center – Office 365 | Microsoft Docs

Monitor Microsoft 365 Security with Azure Sentinel

• Plan and implement Azure Sentinel
  • Microsoft Azure Sentinel overview
  • What is Azure Sentinel? | Microsoft Docs
  • Quickstart: Onboard in Azure Sentinel | Microsoft Docs
  • Microsoft 365 Defender integration with Azure Sentinel | Microsoft Docs
• Configure playbooks in Azure Sentinel
  • Tutorial: Use playbooks with automation rules in Azure Sentinel | Microsoft Docs
• Manage and monitor Azure Sentinel
  • Visualize your data using Azure Monitor Workbooks in Azure Sentinel | Microsoft Docs
• Respond to threats in Azure Sentinel
  • Detect threats with built-in analytics rules in Azure Sentinel | Microsoft Docs
  • Create custom analytics rules to detect threats with Azure Sentinel | Microsoft Docs

Implement and manage information protection (15-20%)

Secure data access within Office 365

• Implement and manage Customer Lockbox
  • Customer Lockbox Requests – Microsoft 365 Compliance | Microsoft Docs
• Configure data access in Office 365 collaboration workloads
  • Microsoft 365 inter-tenant collaboration – Microsoft 365 Enterprise | Microsoft Docs
  • Microsoft 365 external sharing and B2B collaboration – Azure AD | Microsoft Docs
• Configure B2B sharing for external users
  • What is B2B collaboration in Azure Active Directory? | Microsoft Docs
  • Enable B2B external collaboration settings – Azure AD | Microsoft Docs

Manage sensitivity labels

• Plan a sensitivity label solution
  • What is Azure Information Protection (AIP)? | Microsoft Docs
  • Requirements for Azure Information Protection – AIP | Microsoft Docs
  • Azure Information Protection deployment roadmap | Microsoft Docs
  • Tutorial – Edit the Azure Information Protection policy – AIP | Microsoft Docs
  • Learn about sensitivity labels – Microsoft 365 Compliance | Microsoft Docs
  • Get started with sensitivity labels – Microsoft 365 Compliance | Microsoft Docs
  • The client for Azure Information Protection – AIP | Microsoft Docs
• Configure sensitivity labels and policies.
  • Manage sensitivity labels in Office apps – Microsoft 365 Compliance | Microsoft Docs
  • Migrate Azure Information Protection labels to unified sensitivity labels – AIP | Microsoft Docs
  • Enable sensitivity labels for Office files in SharePoint and OneDrive – Microsoft 365 Compliance | Microsoft Docs
  • Create and publish sensitivity labels – Microsoft 365 Compliance | Microsoft Docs
  • Restrict access to content using sensitivity labels to apply encryption – Microsoft 365 Compliance | Microsoft Docs
  • Automatically apply a sensitivity label to content in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
• Configure and use label analytics
  • Analytics and central reporting for Azure Information Protection (AIP) | Microsoft Docs
• Use sensitivity labels with Teams, Sharepoint, OneDrive and Office apps
  • Use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites – Microsoft 365 Compliance | Microsoft Docs

Manage Data Loss Prevention (DLP)

• Plan a DLP solution
  • Learn about data loss prevention – Microsoft 365 Compliance | Microsoft Docs
  • Learn about Microsoft 365 Endpoint data loss prevention – Microsoft 365 Compliance | Microsoft Docs
  • Plan for data loss prevention – Microsoft 365 Compliance | Microsoft Docs
• Create and manage DLP policies
  • Get started with the default DLP policy – Microsoft 365 Compliance | Microsoft Docs
  • Create a DLP policy from a template – Microsoft 365 Compliance | Microsoft Docs
  • Create, test, and tune a DLP policy – Microsoft 365 Compliance | Microsoft Docs
  • Get started with Microsoft 365 data loss prevention on-premises scanner (preview) – Microsoft 365 Compliance | Microsoft Docs
  • Get started with Microsoft 365 Endpoint data loss prevention – Microsoft 365 Compliance | Microsoft Docs
  • Onboarding methods and tools for Windows 10 devices – Microsoft 365 Compliance | Microsoft Docs
  • Data loss prevention and Microsoft Teams – Microsoft 365 Compliance | Microsoft Docs
  • Using Endpoint data loss prevention – Microsoft 365 Compliance | Microsoft Docs
• Create and manage sensitive information types
  • Learn about sensitive information types – Microsoft 365 Compliance | Microsoft Docs
  • Get started with custom sensitive information types – Microsoft 365 Compliance | Microsoft Docs
  • Create a custom sensitive information type using PowerShell – Microsoft 365 Compliance | Microsoft Docs
  • Sensitive information type entity definitions – Microsoft 365 Compliance | Microsoft Docs
  • Create custom sensitive information types with Exact Data Match – Microsoft 365 Compliance | Microsoft Docs
  • Customize a built-in sensitive information type – Microsoft 365 Compliance | Microsoft Docs
  • Create a sensitive information type policy using Office 365 Message Encryption – Microsoft 365 Compliance | Microsoft Docs
  • Use sensitivity labels as conditions in DLP policies – Microsoft 365 Compliance | Microsoft Docs
• Monitor DLP reports
  • View the reports for data loss prevention – Microsoft 365 Compliance | Microsoft Docs
  • How DLP works with Security & Compliance Center & Exchange admin center – Microsoft 365 Compliance | Microsoft Docs
• Manage DLP notifications
  • Send email notifications and show policy tips for DLP policies – Microsoft 365 Compliance | Microsoft Docs
  • Configure and view alerts for data loss prevention policies – Microsoft 365 Compliance | Microsoft Docs

Implement and manage Microsoft Cloud App Security

• Plan Cloud App Security implementation
  • What is Cloud App Security? | Microsoft Docs
  • Differences between Cloud App Security and Office 365 Cloud App Security | Microsoft Docs
  • Discovery capability differences for Cloud App Security and Azure AD | Microsoft Docs
  • Deploy Cloud App Security | Microsoft Docs
  • Best practices for protecting your organization | Microsoft Docs
  • Connect Office 365 to Cloud App Security | Microsoft Docs
  • Scope your Microsoft Cloud App Security deployment | Microsoft Docs
  • MCAS Licensing
  • MCAS webinars | Microsoft Docs
• Configure Microsoft Cloud App Security
  • Get security configuration recommendations for your public cloud platforms | Microsoft Docs
  • Set up your organization’s settings in Cloud App Security | Microsoft Docs
  • Network requirements | Microsoft Docs
  • Manage admin access to the Cloud App Security portal | Microsoft Docs
  • Set IP ranges and tags | Microsoft Docs
• Manage cloud app discovery
  • Deploy Cloud Discovery | Microsoft Docs
  • Integrate Microsoft Defender for Endpoint with Cloud App Security | Microsoft Docs
  • Working with discovered apps in Cloud App Security | Microsoft Docs
  • Create snapshot reports of Cloud Discovery cloud app use | Microsoft Docs
  • Advanced log collector management | Microsoft Docs
  • Enrich Cloud App Security Discovery data with Azure AD usernames | Microsoft Docs
  • Cloud App Security discovered app filters and queries | Microsoft Docs
• Manage entries in the Cloud app catalog
  • Add custom apps to Cloud Discovery in Cloud App Security | Microsoft Docs
• Manage apps in Cloud App Security
  • Connect apps to get visibility and control | Microsoft Docs
  • Control cloud app usage by creating policies | Microsoft Docs
• Manage Microsoft Cloud App Security
  • Working with the Cloud App Security dashboard | Microsoft Docs
  • Working with the risk score | Microsoft Docs
  • Working with discovered apps in Cloud App Security | Microsoft Docs
  • Azure security baseline for Microsoft Cloud App Security | Microsoft Docs
• Configure Cloud App Security connectors and Oauth apps
  • Control which third-party cloud OAuth apps get permissions | Microsoft Docs
  • Investigate and remediate risky OAuth apps tutorial | Microsoft Docs
  • Create policies to control OAuth apps in Cloud App Security | Microsoft Docs
• Configure Cloud App Security policies and templates
  • Policy template reference for Cloud App Security | Microsoft Docs
  • Create Cloud App Security access policies to allow and block access | Microsoft Docs
  • Create session policies in Cloud App Security | Microsoft Docs
  • Create policies to control activities in Cloud App Security | Microsoft Docs
  • Monitor and protect files in cloud apps | Microsoft Docs
• Review, interpret and respond to Cloud App Security alerts, reports, dashboards and logs.
  • Monitor alerts raised in Cloud App Security | Microsoft Docs
  • Create anomaly detection policies in Cloud App Security | Microsoft Docs
  • Create snapshot reports of Cloud Discovery cloud app use | Microsoft Docs
  • Generate reports – Microsoft Cloud App Security | Microsoft Docs
  • Cloud App Security anomaly detection alerts investigation guide | Microsoft Docs
  • Azure Sentinel integration with Cloud App Security | Microsoft Docs

Manage governance and compliance features in Microsoft 365 (25-30%)

Configure and analyze security reporting

• Monitor and manage device security status using Microsoft Endpoint Manager Admin Center
  • Check the success or failure of security baselines in Microsoft Intune | Microsoft Docs
  • Device management in Microsoft 365 | Microsoft Docs
• Manage and monitor security and dashboards using Microsoft 365 Security Center
  • Microsoft 365 Defender overview, combining MDO, MDE, MDI, and MCAS | Microsoft Docs
  • Reports in the Security & Compliance Center – Microsoft 365 Compliance | Microsoft Docs
  • Security dashboard overview – Office 365 | Microsoft Docs
  • Smart reports, insights – Microsoft 365 Security & Compliance Center – Office 365 | Microsoft Docs
  • View email security reports – Office 365 | Microsoft Docs
  • Search the role group changes or admin audit logs in Exchange Online | Microsoft Docs
• Plan for custom security reporting with Graph Security API
  • Use the Microsoft Graph Security API – Microsoft Graph v1.0 | Microsoft Docs
• Use secure score dashboards to review actions and recommendations
  • Microsoft Secure Score | Microsoft Docs
  • Assess your security posture through Microsoft Secure Score | Microsoft Docs
  • Track your Microsoft Secure Score history and meet goals | Microsoft Docs
• Configure alert policies
  • Microsoft 365 alert policies – Microsoft 365 Compliance | Microsoft Docs

Manage and analyze audit logs and reports

• Plan for auditing and reporting
  • Auditing and reporting in Microsoft cloud services – Microsoft Service Assurance | Microsoft Docs
  • Auditing in Office 365 (for Admins) (microsoft.com)
  • Turn auditing on or off – Microsoft 365 Compliance | Microsoft Docs
• Perform audit log search
  • Search the audit log to troubleshoot common scenarios – Microsoft 365 Compliance | Microsoft Docs
  • Detailed properties in the audit log – Microsoft 365 Compliance | Microsoft Docs
  • Export, configure, and view audit log records – Microsoft 365 Compliance | Microsoft Docs
  • Search the audit log to troubleshoot common scenarios – Microsoft 365 Compliance | Microsoft Docs
  • Use sharing auditing in the audit log – Microsoft 365 Compliance | Microsoft Docs
  • Search the audit log for events in Microsoft Teams – Microsoft Teams | Microsoft Docs
• Review and interpret compliance reports and dashboards
  • Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
  • Reports in the Security & Compliance Center – Microsoft 365 Compliance | Microsoft Docs
• Configure audit alert policy
  • Microsoft 365 alert policies – Microsoft 365 Compliance | Microsoft Docs
  • Manage audit log retention policies – Microsoft 365 Compliance | Microsoft Docs

Manage data governance and retention

• Plan for data governance and retention
  • Data governance and retention in your Microsoft 365 tenant—a secure and highly capable solution
  • Microsoft Information Governance in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
  • Get started with retention policies and retention labels – Microsoft 365 Compliance | Microsoft Docs
  • Learn about retention policies & labels to automatically retain or delete content – Microsoft 365 Compliance | Microsoft Docs
  • Learn about retention for SharePoint and OneDrive – Microsoft 365 Compliance | Microsoft Docs
  • Learn about retention for Teams – Microsoft 365 Compliance | Microsoft Docs
• Review and interpret data governance reports and dashboards
  • Learn about data classification – Microsoft 365 Compliance | Microsoft Docs
  • Smart reports, insights – Microsoft 365 Security & Compliance Center – Office 365 | Microsoft Docs
• Configure retention labels and policies
  • Create and configure retention policies to automatically retain or delete content – Microsoft 365 Compliance | Microsoft Docs
  • Use file plan to manage retention labels throughout the content lifecycle – Microsoft 365 Compliance | Microsoft Docs
  • Set up an archive and deletion policy for mailboxes in your organization – Microsoft 365 Compliance | Microsoft Docs
  • Manage retention policies for Microsoft Teams – Microsoft Teams | Microsoft Docs
  • Create retention labels and apply them in apps to retain or delete content – Microsoft 365 Compliance | Microsoft Docs
  • Automatically apply a retention label to retain or delete content – Microsoft 365 Compliance | Microsoft Docs
  • Create and publish retention labels by using PowerShell – Microsoft 365 Compliance | Microsoft Docs
• Define data governance event types
  • Start retention when an event occurs – Microsoft 365 Compliance | Microsoft Docs
• Define and manage communication compliance policies
  • Learn about communication compliance – Microsoft 365 Compliance | Microsoft Docs
  • Get started with communication compliance – Microsoft 365 Compliance | Microsoft Docs
  • Investigate and remediate communication compliance alerts – Microsoft 365 Compliance | Microsoft Docs
  • Communication compliance feature reference – Microsoft 365 Compliance | Microsoft Docs
  • Case study – Contoso quickly configures an offensive language policy for Microsoft Teams, Exchange, and Yammer communications – Microsoft 365 Compliance | Microsoft Docs
• Configure Information holds
  • In-Place Hold and Litigation Hold | Microsoft Docs
  • How to identify the type of hold placed on an Exchange Online mailbox – Microsoft 365 Compliance | Microsoft Docs
  • Create a Litigation hold – Microsoft 365 Compliance | Microsoft Docs
  • Manage holds in Advanced eDiscovery – Microsoft 365 Compliance | Microsoft Docs
  • Remove an In-Place Hold | Microsoft Docs
• Find and recover deleted Office 365 data
  • Recover deleted messages in a user’s mailbox in Exchange Online | Microsoft Docs
• Configure data archiving
  • Enable archive mailboxes in the Security & Compliance Center – Microsoft 365 Compliance | Microsoft Docs
  • Archive features in Exchange Online Archiving – Service Descriptions | Microsoft Docs
  • Overview of unlimited archiving – Microsoft 365 Compliance | Microsoft Docs
  • Enable unlimited archiving – Admin Help – Microsoft 365 Compliance | Microsoft Docs
  • Archive third-party data – Microsoft 365 Compliance | Microsoft Docs
• Manage inactive mailboxes
  • Overview of inactive mailboxes – Microsoft 365 Compliance | Microsoft Docs
  • Create and manage inactive mailboxes – Microsoft 365 Compliance | Microsoft Docs
  • Recover an inactive mailbox – Microsoft 365 Compliance | Microsoft Docs
  • Delete an inactive mailbox – Microsoft 365 Compliance | Microsoft Docs
  • Restore an inactive mailbox – Microsoft 365 Compliance | Microsoft Docs

Manage search and investigation

• Plan for content search and eDiscovery
  • Microsoft 365 eDiscovery solutions – Microsoft 365 Compliance | Microsoft Docs
  • Create and run a Content search in the Microsoft 365 compliance center – Microsoft 365 Compliance | Microsoft Docs
  • Limits for Content search and Core eDiscovery in the compliance center – Microsoft 365 Compliance | Microsoft Docs
• Delegate permissions to use search and discovery tools
  • Assign eDiscovery permissions in the Microsoft 365 compliance center – Microsoft 365 Compliance | Microsoft Docs
• Use search and investigation tools to perform content searches
  • Overview of the Advanced eDiscovery solution in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
  • Conduct an eDiscovery investigation of content – Microsoft Teams | Microsoft Docs
  • Create and run a Content search in the Microsoft 365 compliance center – Microsoft 365 Compliance | Microsoft Docs
• Export content search results
  • Export Content search results – Microsoft 365 Compliance | Microsoft Docs
  • Export a Content Search report – Microsoft 365 Compliance | Microsoft Docs
  • Export and download content from a Core eDiscovery case – Microsoft 365 Compliance | Microsoft Docs
• Manage eDiscovery cases
  • Get started with Core eDiscovery cases in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
  • Set up Advanced eDiscovery in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
  • Manage legal investigations in Microsoft 365 – Microsoft 365 Compliance | Microsoft Docs
  • Create eDiscovery holds in a Core eDiscovery case – Microsoft 365 Compliance | Microsoft Docs
  • Close, reopen, and delete Core eDiscovery cases – Microsoft 365 Compliance | Microsoft Docs
  • Add custodians to an Advanced eDiscovery case – Microsoft 365 Compliance | Microsoft Docs
  • View custodian audit activity – Microsoft 365 Compliance | Microsoft Docs

Manage data privacy regulation compliance

• Plan for regulatory compliance in Microsoft 365
  • Compliance offerings for Microsoft 365, Azure, and other Microsoft services. | Microsoft Docs
  • Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
  • Microsoft Compliance Manager quickstart guide – Microsoft 365 Compliance | Microsoft Docs
  • Get started with Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
• Review and interpret GDPR dashboards and reports
  • General Data Protection Regulation – Microsoft GDPR | Microsoft Docs
  • Microsoft 365 GDPR action plan, priorities for your first 30 days, 90 days, and beyond – Microsoft GDPR | Microsoft Docs
  • Additional steps to export system-generated log data – Microsoft GDPR | Microsoft Docs
  • New Microsoft 365 features to accelerate GDPR compliance | Microsoft Security Blog
• Manage Data Subject Requests (DSRs)
  • Data Subject Requests for the GDPR and CCPA – Microsoft GDPR | Microsoft Docs
  • Office 365 Data Subject Requests Under the GDPR and CCPA – Microsoft GDPR | Microsoft Docs
• Administer Compliance Manager in Microsoft 365 compliance center
  • Microsoft Compliance Manager quickstart guide – Microsoft 365 Compliance | Microsoft Docs
  • Working with assessment templates in Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
  • Assign and complete improvement actions in Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
  • Microsoft Compliance Configuration Analyzer for Compliance Manager – Microsoft 365 Compliance | Microsoft Docs
• Review Compliance Manager reports
  • Use Compliance Manager to manage improvement actions | Microsoft Docs
  • Compliance score calculation – Microsoft 365 Compliance | Microsoft Docs
• Create and perform Compliance Manager assessments and action items
  • Build and manage assessments in Microsoft Compliance Manager – Microsoft 365 Compliance | Microsoft Docs

MS-500 Tips and other resources

On top of these Microsoft resources, I always recommend trying to get some actual time with the toolsets if possible. This can be difficult to do unless you have a test Microsoft 365 subscription, so sometimes its worth discussing with your manager or even a colleague about building a test environment.

Youtube can always be a good resource to look at, if you are more of a visual learner, you can find a playlist for MS-500 here. Alternatively, check out some of the great courses around the topics on Pluralsight.

All the best and good luck on your journey to passing MS-500 and gaining your Microsoft 365 Certified: Security Administrator Associate certification. If you have any further links and resources then please let me know in the comments and I can add them to this blog.