NOTE I HAVE UPDATED THIS POST FOR 2020- Preparing for the MS-500 Microsoft 365 Security Administration Exam (February 2020 Update)
The MS-500 Microsoft 365 Security Administration exam is currently available in beta, and as you can see if you scroll down, this exam expects you to have very broad exposure across the security capabilities of the Microsoft 365 E5 suite. This guide is effectively the fifth post in this series, and if you have already taken the exams listed below you will find that some of the preparation for those exam will help out here.
Preparing for the MS-101 Microsoft 365 Mobility and Security Exam (BETA)
Preparing for the MD-100 Windows 10 Exam (BETA)
Preparing for the MD-101 Managing Modern Desktops Exam (BETA)
There’s a huge amount of content to work through in the links below, and I’ll publish an updated version once the exam goes live in order to incorporate any changes with the final exam.
For the latest updates to exam prep guides please check https://intunedin.net/exams
Implement and manage identity and access (30-35%)
Secure Microsoft 365 hybrid environments
- plan Azure AD authentication options
- plan Azure AD synchronization options
- monitor and troubleshoot Azure AD Connect events
- implement Azure AD membership
- implement password management
- configure and manage identity governance
Implement authentication methods
- plan sign-on security
- implement multi-factor authentication (MFA)
- manage and monitor MFA
- plan and implement device authentication methods like Windows Hello
- configure and manage Azure AD user authentication options and self-service password management
Implement conditional access
- plan for compliance and conditional access policies
- configure and manage device compliance for endpoint security
- implement and manage conditional access
Implement role-based access control (RBAC)
- plan for roles
- configure roles
- audit roles
Implement Azure AD Privileged Identity Management (PIM)
- plan for Azure PIM
- assign eligibility and activate admin roles
- manage Azure PIM role requests and assignments
- monitor PIM history and alerts
Implement Azure AD Identity Protection
- implement user risk policy
- implement sign-in risk policy
- configure Identity Protection alerts
- review and respond to risk events
Implement and manage threat protection (20-25%)
Implement an enterprise hybrid threat protection solution
- plan an Microsoft Defender for Identity solution
- install and configure Microsoft Defender for Identity
- monitor and manage Microsoft Defender for Identity
Implement device threat protection
- plan a Microsoft Defender for Endpoint solution
- implement Microsoft Defender for Endpoint
- manage and monitor Microsoft Defender for Endpoint
Implement and manage device and application protection
- plan for device and application protection
- configure and manage Windows Defender Application Guard
- configure and manage Windows Defender Application Control
- configure and manage exploit protection
- configure Secure Boot
- configure and manage Windows device encryption
- configure and manage non-Windows device encryption
- plan for securing applications data on devices
- implement application protection policies
Implement and manage Microsoft Defender for Office 365
- configure Microsoft Defender for Office 365
- monitor Microsoft Defender for Office 365
- conduct simulated attacks using Attack Simulator
Implement Azure Sentinel for Microsoft 365
- plan and implement Azure Sentinel
- configure playbooks in Azure Sentinel
- manage and monitor Azure Sentinel
- respond to threats in Azure Sentinel
Implement and manage information protection (15-20%)
Secure data access within Office 365
- implement and manage Customer Lockbox
- configure data access in Office 365 collaboration workloads
- configure B2B sharing for external users
Manage sensitivity labels
- plan an sensitivity labels solution
- configure Sensitivity labels and policies
- configure sensitivity labels and policies
- configure and use label analytics
- use sensitivity labels with Teams, SharePoint, OneDrive and Office apps
Manage Data Loss Prevention (DLP)
- plan a DLP solution
- create and manage DLP policies
- create and manage sensitive information types
- monitor DLP reports
- manage DLP notifications
Implement and manage Microsoft Cloud App Security
- plan Cloud App Security implementation
- configure Microsoft Cloud App Security
- manage cloud app discovery
- manage entries in the Cloud app catalog
- manage apps in Cloud App Security
- manage Microsoft Cloud App Security
- configure Cloud App Security connectors and Oauth apps
- configure Cloud App Security policies and templates
- review, interpret and respond to Cloud App Security alerts, reports, dashboards and logs
Manage governance and compliance features in Microsoft 365 (25-30%)
Configure and analyze security reporting
- monitor and manage device security status using Microsoft Endpoint Manager Admin Center
- manage and monitor security reports and dashboards using Microsoft 365 Security Center
- plan for custom security reporting with Graph Security API
- use secure score dashboards to review actions and recommendations
- configure alert policies
Manage and analyze audit logs and reports
- plan for auditing and reporting
- perform audit log search
- review and interpret compliance reports and dashboards
- configure audit alert policy
Manage data governance and retention
- plan for data governance and retention
- review and interpret data governance reports and dashboards
- configure retention policies
- define data governance event types
- define and manage communication compliance policies
- configure Information holds
- find and recover deleted Office 365 data
- configure data archiving
- manage inactive mailboxes
Manage search and investigation
- plan for content search and eDiscovery
- search for personal data
- monitor for leaks of personal data
- delegate permissions to use search and discovery tools
- use search and investigation tools to perform content searches
- export content search results
- manage eDiscovery cases
Manage data privacy regulation compliance
- plan for regulatory compliance in Microsoft 365
- review and interpret GDPR dashboards and reports
- manage Data Subject Requests (DSRs)
- administer Compliance Manager in Microsoft 365 compliance center
- review Compliance Manager reports
- create and perform Compliance Manager assessments and action items
For the latest updates to exam prep guides please check https://intunedin.net/exams
This one looks very tough!
Thanks. Doing the exam tomorrow.
How’d it go?
Still waiting on results but it wasn’t quite I expected. I thought it was going to be a bit more high level, but there were some specifics that only an admin of a particular workload would know off the top of their head. I thought it was a good exam to really get people who are prepping to understand that M365 isn’t just a set of licensing options rather than pieces that are working together at a much deeper level.
Could u let us know your experience about ur exam MS-500 Exam?
Hi Arun – it’s really important to approach this as the M365 E5 exam, and pay a lot of attention to the different ATPs, not just Office 365 ATP. I don’t think any of the questions were particularly difficult, but there were certainly a few that I just wasn’t sure because of limited experience with some of the items that were tested. If someone goes in just with Office 365 or EMS experience, they might find the exam pretty tough.
LikeLiked by 2 people
Is there any way I could attend Mock test for this MS 500 Exam before I attend to actual exam.
I have experience and still learning all three ATP’s – O365 ATP, Microsoft Defender ATP & Azure ATP. However, I do not have experience in Azure AD Connect.
So that is why i like to attend some Mock test. Kindly let me know is there any options?
FYI, I have downloaded modern desktop deployment kit for setup.
And thank you for your kind Response Mark.
I haven’t seen a practice exam for this one yet, I usually go to measureup when I need one.
What type of lab do we need for MS-500?
The important things for this are to get access to an M365 E5 or similar, and have the ability to build out VMs to try things AATP. If you need the AD infrastructure as well, use the modern desktop deployment kit as that speeds up the deployment process.
LikeLiked by 2 people
I just took the exam today and I’m waiting for the results. I’ve worked with EMS+E5 for a couple of years now and I feel I’m an expert within this license SKU. I’ve deployed nearly all the technologies covered on this exam as well as being the Exchange and SharePoint admin for a large organization where I migrated these workloads to O365. I used PluralSight to cover the areas I was weak in as well as this blog (Defender ATP and 365 Labels) but overall I feel confident that I passed this exam. There were definitely questions I did not know the answer to and I agree with Mark, it does pay to have experience being an Exchange and SharePoint administrator going into this exam.
These are the subjects which were covered on my exam:
Azure Information Protection
Labels (sensitivity, retention)
AD Connect (federated identity, password hash sync, SSO)
Exchange (retention policies, mailbox auditing, DLP, PowerShell)
Sharepoint/OneDrive/UnfiedGroups/Teams (DLP, sharing/partner organizations, PowerShell)
Azure AD (roles, groups, dynamic groups, hybrid identity, hybrid device)
Azure user risk policies/events
Azure Conditional Access Policies
Security and Compliance roles
M365 Unified Audit Log
LikeLiked by 1 person
Thank for the feedback John. I think EMS people have a big advantage because they have to know something about the Office 365 and/or Windows 10 apps they have to protect.. So far I’m 7/7 for the beta exams (I did AZ100/AZ101/AZ102 as well as MS/MD), and I’m hoping this keeps the streak going.
Just an update, I received an email today that I passed this exam and it now shows on my transcript.
This is my first beta exam so for those of you who have passed these before, how long before you can claim your badge on Acclaim — or, will I never receive a badge for this exam?
LikeLiked by 1 person
Congrats John – I’m in the same boat, got the results but no badge yet. Normally beta exams lag a bit in terms of everything working through the system, but if you don’t see anything within a few weeks contact the regional support center and they can check on it for you.
Awesome, thanks Mark! Again, I appreciate the blog, it was helpful! Congrats on passing yet another exam 🙂
Same here. Waiting for the badge and the Enterprise Administrator Expert certification as I have completed MS-100 and MS-101 as well.
It’s showing up in my transcript now, but no badge just yet. I guess this means we just get to celebrate when we see the score report, again when it shows on the transcript, and a final time when we get the badge. =)
Hi, I just finished the MS-100 and MS-101 exam and now I’m thinking about taking the MS-500 exam to collect the Expert level title. Is there somebody who took the MS-101 and MS-500 and can you tell where the differences are? Is the MS-500 harder/easier to study than the MS-101?
To me it looks like the MS-500 covers most of the MS-101 topics, but more focused on implementation, rather than design (like the MS-101).
Hi Russell – I found it was broader, and I over prepared on the roles/rights side because I was a bit under prepared for that in the MS-10x exams, as that’s something I’d be referencing as needed and not trying to memorise them. The main thing I remember during that exam was I was glad that I’d spend the last few years focused on EMS, not just working with O365. The feedback I’m getting from people doing exams at the moment (not just this one) is that they aren’t really prepared for the EMS and Windows 10 pieces, including Defender ATP.
Hi Mark, thanks for your reply and the time you took to comment. For me it’s still a bit unclear how the MS-500 differs from the MS-100/101. I’m studying and for now the only difference I find is that some objectives are more detailed. But I would argue that overall the MS-100/101 do cover most of the MS-500 objectives, perhaps differing in design vs implementation. Would you agree?
How focused is the exam on Powershell? And with the Powershell questions do they want you to input commands or is it a multiple choice?
Hi Paul – there wasn’t much PowerShell at all from memory.
Just wondering if there are any recommendations for Test Labs with this exam.
I was thinking of spinning up a VM for sync testing and just signing up for the E5 trial but I wasn’t sure about a month of time being enough.
We have M365 at work but they only use E3 so can’t go through all the ATP features.
Hi Paul – I would recommend signing up for the M365 E5 trial, even though its only 30 days you could spin another tenant up pretty quickly.
I did do that I also found demo.microsoft.com I was able to create test environments that have a 90 day expiry.