Microsoft 365 Security Administration (MS-500T00)

Module 1 : Create, configure, and manage identities

• Create, configure, and manage users
• Create, configure, and manage groups
• Manage licenses
• Explain custom security attributes and automatic user provisioning

Module 2 : Explore identity synchronization

• Describe the Microsoft 365 authentication and provisioning options
• Explain directory synchronization
• Explain how Azure AD Connect enables coexistence between your on-premises Active Directory environment and Microsoft 365

Module 3 : Implement and manage hybrid identity

• Plan, design, and implement Azure Active Directory Connect (AADC)
• Manage Azure Active Directory Connect (AADC)
• Manage password hash synchronization (PHS)
• Manage pass-through authentication (PTA)
• Manage seamless single sign-on (seamless SSO)
• Manage federation excluding manual ADFS deployments
• Troubleshoot synchronization errors
• Implement and manage Azure Active Directory Connect Health

Module 4 : Implement and manage external identities

• Manage external collaboration settings in Azure Active Directory
• Invite external users (individually or in bulk)
• Manage external user accounts in Azure Active Directory
• Configure identity providers (social and SAML/WS-fed)

Module 5 : Manage secure user access in Microsoft 365

• Manage user passwords
• Describe pass-through authentication
• Enable multifactor authentication
• Describe self-service password management
• Implement Azure AD Smart Lockout
• Implement entitlement packages in Azure AD Identity Governance
• Implement conditional access policies
• Create and perform an access review

Module 6 : Manage user authentication

• Administer authentication methods (FIDO2 / Passwordless)
• Implement an authentication solution based on Windows Hello for Business
• Configure and deploy self-service password reset
• Deploy and manage password protection
• Implement and manage tenant restrictions

Module 7 : Plan, implement, and administer Conditional Access

• Plan and implement security defaults.
• Plan conditional access policies.
• Implement conditional access policy controls and assignments (targeting, applications, and conditions).
• Test and troubleshoot conditional access policies.
• Implement application controls.
• Implement session management.
• Configure smart lockout thresholds.

Module 8 : Plan and implement privileged access

• Define a privileged access strategy for administrative users (resources, roles, approvals, and thresholds)
• Configure Privileged Identity Management for Azure AD roles
• Configure Privileged Identity Management for Azure resources
• Assign roles
• Manage PIM requests
• Analyze PIM audit history and reports
• Create and manage emergency access accounts

Module 9 : Plan and implement entitlement management

• Define catalogs.
• Define access packages.
• Plan, implement and manage entitlements.
• Implement and manage terms of use.
• Manage the lifecycle of external users in Azure AD Identity Governance settings.

Module 10 : Manage Azure AD Identity Protection

• Implement and manage a user risk policy
• Implement and manage sign-in risk policies
• Implement and manage MFA registration policy
• Monitor, investigate, and remediate elevated risky users

Module 11 : Protect against threats with Microsoft Defender for Endpoint

• Define the capabilities of Microsoft Defender for Endpoint.
• Understand how to hunt threats within your network.
• Explain how Microsoft Defender for Endpoint can remediate risks in your environment.

Module 12 : Deploy the Microsoft Defender for Endpoint environment

• Create a Microsoft Defender for Endpoint environment
• Onboard devices to be monitored by Microsoft Defender for Endpoint
• Configure Microsoft Defender for Endpoint environment settings

Module 13 : Protect against malicious attacks and unauthorized access with Microsoft Edge

• Describe how Microsoft Edge is built for secure browsing
• Use Microsoft Defender SmartScreen and Application Guard to protect against malicious attacks and unauthorized access.
• Manage Microsoft Edge security options through policies and controls in Microsoft Endpoint Manager

Module 14 : Understand Microsoft 365 encryption

• Explain how encryption mitigates the risk of unauthorized data disclosure.
• Describe Microsoft data-at-rest and data-in-transit encryption solutions.
• Explain how Microsoft 365 implements service encryption to protect customer data at the application layer.
• Understand the differences between Microsoft managed keys and customer managed keys for use with service encryption.

Module 15 : Understand app management using Microsoft Endpoint Manager

• Understand how your organization's apps can be configured and protected.
• Understand the app management lifecycle.
• Learn about the data protection framework using app protection policies.

Module 16 : Manage device compliance

• Plan for device compliance by defining the rules and settings that must be configured on a device for it to be considered compliant
• Configure conditional users and groups for deploying profiles, policies, and apps
• Create Conditional Access policies to implement automated access control decisions for accessing your cloud apps
• Monitor enrolled devices to control their Intune activities and compliance status

Module 17 : Remediate risks with Microsoft Defender for Office 365

• Define the capabilities of Microsoft Defender for Office 365.
• Understand how to simulate attacks within your network.
• Explain how Microsoft Defender for Office 365 can remediate risks in your environment.

Module 18 : Query, visualize, and monitor data in Microsoft Sentinel

• Visualize security data using Microsoft Sentinel Workbooks.
• Understand how queries work.
• Explore workbook capabilities.
• Create a Microsoft Sentinel Workbook.

Module 19 : Create and manage sensitive information types

• Recognize the difference between built-in and custom sensitivity labels
• Configure sensitive information types with exact data match-based classification
• Implement document fingerprinting
• Create custom keyword dictionaries

Module 20 : Apply and manage sensitivity labels

• Apply sensitivity labels to Microsoft Teams, Microsoft 365 groups, and SharePoint sites.
• Monitor label usage using label analytics.
• Configure on-premises labeling.
• Manage protection settings and marking for applied sensitivity labels.
• Apply protections and restrictions to email.
• Apply protections and restrictions to files.

Module 21 : Prevent data loss in Microsoft Purview

• Discuss the data loss prevention solution and its benefits.
• Describe the data loss prevention configuration process.
• Explain what users will experience when the solution is implemented.

Module 22 : Manage data loss prevention policies and reports in Microsoft 365

• Review and analyze DLP reports.
• Manage permissions for DLP reports.
• Identify and mitigate DLP policy violations.
• Mitigate DLP violations in Microsoft Defender for Cloud Apps.

Module 23 : Manage the data lifecycle in Microsoft Purview

• Discuss the Data Lifecycle Management solution and its benefits.
• List the customer scenarios the Data Lifecycle Management solution addresses.
• Describe the Data Lifecycle Management configuration process.
• Explain what users will experience when the solution is implemented.
• Articulate deployment and adoption best practices.

Module 24 : Manage data retention in Microsoft 365 workloads

• Describe the retention features in Microsoft 365 workloads.
• Configure retention settings in Microsoft Teams, Yammer, and SharePoint Online.
• Recover content protected by retention settings.
• Regain protected items from Exchange Mailboxes.

Module 25 : Manage records in Microsoft Purview

• Discuss the Microsoft Purview Records Management solution and its benefits.
• List the customer scenarios the Microsoft Purview Records Management solution addresses.
• Describe the Microsoft Purview Records Management configuration process.
• Explain what users will experience when the solution is implemented.
• Articulate deployment and adoption best practices.

Module 26 : Manage compliance in Microsoft 365 and Exchange Online

• Explain retention policies.
• Explain data loss prevention policies.
• Explain audit logs.
• Explain content search.

Module 27 : Manage Microsoft Purview eDiscovery (Premium)

• Describe how Microsoft Purview eDiscovery (Premium) builds on eDiscovery (Standard).
• Describe the basic workflow of eDiscovery (Premium).
• Create and manage cases in eDiscovery (Premium).
• Manage custodians and non-custodial data sources.
• Analyze case content and use analytical tools to reduce the size of search result sets.

Module 28 : Manage regulatory and privacy requirements with Microsoft Priva

• Create and manage risk management policies for data overexposure, data transfer, and data minimization
• Investigate and remediate risk alerts
• Send user notifications
• Create and manage Subject Rights Requests
• Estimate and retrieve subject data
• Review subject data
• Create subject rights reports

Module 29 : Prepare Microsoft Purview Communication Compliance

• List the enhancements in communication compliance over Office 365 Supervision policies, which it will replace.
• Explain how to identify and remediate code-of-conduct policy violations.
• List the prerequisites that need to be met before creating communication compliance policies.
• Describe the types of built-in, pre-defined policy templates.

Module 30 : Manage insider risk in Microsoft Purview

• Explain how Microsoft Purview Insider Risk Management can help prevent, detect, and contain internal risks in an organization.
• Describe the types of built-in, pre-defined policy templates.
• List the prerequisites that need to be met before creating insider risk policies.
• Explain the types of actions you can take on an insider risk management case.

Module 31 : Plan information barriers

• Describe how information barrier policies can help your organization maintain compliance with relevant industry standards and regulations, and avoid potential conflicts of interest.
• List the types of situations when information barriers would be applicable.
• Explain the process of creating an information barrier policy.
• Explain how to troubleshoot unexpected issues after information barriers are in place.

Module 32 : Implement privileged access management

• Explain the difference between privileged access management and privileged identity management.
• Describe the privileged access management process flow.
• Describe how to configure and enable privileged access management.

Module 33 : Manage Customer Lockbox

• Describe the Customer Lockbox workflow.
• Explain how to approve or deny a Customer Lockbox request.
• Explain how you can audit actions performed by Microsoft engineers when access requests are approved.