The MS-500 exam received a major update this month, so let’s take a look at what’s been changed. The first change to note is that the section weightings have changed. The identity component has been reduced, and threat protection and information protection increased. This balances the exams out quite a bit, but means that if identity is your strength, then the change means the exam might be a little bit tougher for you. I don’t think it’s enough of a difference to make that much of a change though.
| Functional group | Old weighting | New weighting |
| Implement and manage identity and access | 35–40% | 25–30% |
| Implement and manage threat protection | 25–30% | 30–35% |
| Implement and manage information protection | 10-15% | 15–20% |
| Manage governance and compliance features in Microsoft 365 | 20–25% | 20–25% |
What’s new or more of a focus? Here are some of the changes.
- Hybrid authentication referencing password hash sync and pass-through authentication, indicating that federation isn’t a focus
- Self service password reset and Azure AD Password Protection
- FIDO and passwordless
- Use of Microsoft 365 Defender portal for Defender for Identity and Defender for Cloud Apps
- App Governance in Defender for Cloud Apps
- Content Explorer
- Purview Data Map
- Subject Rights Requests in Microsoft Priva
- Adaptive scopes
This is a very broad exam, and the traditional approach I would have recommended would have been to work your way through MS-100, MS-101 and MD-101 before attempting this exam. Why? Each of those three exams covers something that this exam includes, and it means that by the time you get to this exam after you are mostly doing revision, and focusing your preparation on addressing weaknesses rather than learning lots of new things.
However, the addition of the exams in the Security and Compliance track (SC-900, SC-200, SC-300 and SC-400) means that you have additional, more focused exams you could take prior to MS-500. There isn’t really an approach that’s right for everyone, but I would still recommend starting off with exams that focus on your strengths before moving on the ones you know you will find more challenging.
Even if you aren’t planning on sitting any of these other exams prior to sitting MS_500, make sure you take a look at the preparation guides for these exams as they might provide additional content related to the topics you might be struggling with.
Plenty of people do get through this exam without doing the others first, because perhaps that’s all that they want or need for work related purposes, but if you are struggling with the breadth of what this exam includes, it might be worth at least going through the prep material for those exams to fill in some of the fundamentals this exam expects you to know.
Implement and manage identity and access (25-30%)
Plan and implement identity and access for Microsoft 365 hybrid environments
- choose an authentication method to connect to a hybrid environment
- plan and implement pass-through authentication and password hash sync
- plan and implement Azure AD synchronization for hybrid environments
- monitor and troubleshoot Azure AD Connect events
Plan and implement identities in Azure AD
- implement Azure AD group membership
- implement password management, including self-service password reset and Azure AD Password Protection
- Eliminate weak passwords in the cloud
- Deploy self-service password reset
- How it works: Azure AD self-service password reset
- Azure AD Password Protection
- manage external identities in Azure AD and Microsoft 365 workloads
- Plan and implement roles and role groups
- Audit Azure AD
Implement authentication methods
- implement multi-factor authentication (MFA) by using conditional access policy
- manage and monitor MFA
- plan and implement device authentication methods like Windows Hello for Business, FIDO, and passwordless authentication
Implement conditional access
- plan and implement conditional access policies
- plan and implement device compliance policies
- test and troubleshoot conditional access policies
Configure and manage identity governance
- implement Azure AD Privileged Identity Management
- implement and manage entitlement management
- implement and manage access reviews
Implement Azure AD Identity Protection
- implement user risk policy
- implement sign-in risk policy
- configure Identity Protection alerts
- review and respond to risk events
Implement and manage threat protection (30-35%)
Secure identity by using Microsoft Defender for Identity
- plan a Microsoft Defender for Identity solution
- install and configure Microsoft Defender for Identity
- manage and monitor Microsoft Defender for Identity
- Secure score
- Analyze identity-related threats and risks identified in Microsoft 365 Defender
Secure endpoints by using Microsoft Defender for Endpoint
- plan a Microsoft Defender for Endpoint solution
- implement Microsoft Defender for Endpoint
- manage and monitor Microsoft Defender for Endpoint
- analyze and remediate threats and risks to endpoints identified in Microsoft 365 Defender
Secure endpoints by using Microsoft Endpoint Manager
- plan for device and application protection
- configure and manage Windows Defender Application Guard
- configure and manage Windows Defender Application Control
- configure and manage exploit protection
- configure and manage device encryption
- configure and manage application protection policies
- monitor and manage device security status using Microsoft Endpoint Manager admin center
- analyze and remediate threats and risks to endpoints identified in Microsoft Endpoint Manager
Secure collaboration by using Microsoft Defender for Office 365
- plan a Microsoft Defender for Office 365 solution
- configure Microsoft Defender for Office 365
- monitor for threats by using Microsoft Defender for Office 365
- Analyze and remediate threats and risks to collaboration workloads identified in Microsoft 365 Defender
- conduct simulated attacks using Attack Simulation training
Detect and respond to threats in Microsoft 365 by using Microsoft Sentinel
- plan a Microsoft Sentinel solution for Microsoft 365
- implement and configure Microsoft Sentinel for Microsoft 365
- manage and monitor Microsoft 365 security by using Microsoft Sentinel
- respond to threats using built-in playbooks in Microsoft Sentinel
Secure connections to cloud apps by using Microsoft Defender for Cloud Apps
- plan Microsoft Defender for Cloud Apps implementation
- configure Microsoft Defender for Cloud Apps
- manage cloud app discovery
- manage entries in the Microsoft Defender for Cloud app catalog
- manage apps in Microsoft Defender for Cloud Apps
- configure Defender for Cloud Apps connectors and Oauth apps
- configure Defender for Cloud Apps policies and templates
- analyze and remediate threats and risks relating to cloud app connections identified in Microsoft 365 Defender
- Manage App governance in Microsoft Defender for Cloud Apps
Implement and manage information protection (15-20%)
Manage sensitive information
- plan a sensitivity label solution
- create and manage sensitive information types
- configure sensitivity labels and policies
- publish sensitivity labels to Microsoft 365 workloads
- monitor data classification and label usage by using Content explorer and Activity explorer
- apply labels to files and schematized data assets in Microsoft Purview Data Map
Implement and manage Microsoft Purview Data Loss Prevention (DLP)
- plan a DLP solution
- create and manage DLP policies for Microsoft 365 workloads
- implement and manage Endpoint DLP
- monitor DLP
- respond to DLP alerts and notifications
Plan and implement Microsoft Purview Data lifecycle management
- plan for data lifecycle management
- review and interpret data lifecycle management reports and dashboards
- configure retention labels, policies and label policies
- Retention policies
- Retention labels
- Label policies
- plan and implement adaptive scopes
- configure retention in Microsoft 365 workloads
- find and recover deleted Office 365 data
Manage compliance in Microsoft 365 (20–25%)
Manage and analyze audit logs and reports in Microsoft Purview
- plan for auditing and reporting
- investigate compliance activities by using audit logs
- review and interpret compliance reports and dashboards
- configure alert policies
- configure audit retention policies
Plan for, conduct, and manage eDiscovery cases
- recommend eDiscovery Standard or Premium
- plan for content search and eDiscovery
- delegate permissions to use search and discovery tools
- use search and investigation tools to discover and respond
- manage eDiscovery cases
Manage regulatory and privacy requirements
- plan for regulatory compliance in Microsoft 365
- manage regulatory compliance in the Microsoft Purview Compliance Manager
- implement privacy risk management in Microsoft Priva
- Implement and manage Subject Rights Requests in Microsoft Priva
Manage insider risk solutions in Microsoft 365
- implement and manage Customer Lockbox
- implement and manage Communication Compliance policies
- implement and manage Insider Risk Management policies
- implement and manage Information Barrier policies
- implement and manage Privileged Access Management