MS-500: Microsoft 365 Security Administration Training

Lesson

• Identity and Access Management concepts
• The Zero Trust model
• Plan your identity and authentication solution
• User accounts and roles
• Password Management

Lab: Initialize your tenant - users and groups

• Set up your Microsoft 365 tenant
• Manage users and groups

Lab: Password management

• Configure Self-service password reset (SSPR) for user accounts in Azure AD
• Deploy Azure AD Smart Lockout

After completing this module, students will be able to:

• Create and manage user accounts.
• Describe and use Microsoft 365 admin roles.
• Plan for password policies and authentication.
• Describe the concepts of Zero Trust security.
• Explain the Zero Trust model.

Lesson

• Plan directory synchronization
• Configure and manage synchronized identities
• Azure AD Identity Protection

Lab: Implement Identity Synchronization

• Set up your organization for identity synchronization

After completing this module, students will be able to:

• Explain directory synchronization.
• Plan directory synchronization.
• Describe and use Azure AD Connect.
• Configure Azure AD Connect Prerequisites.
• Manage users and groups with directory synchronization.
• Describe Active Directory federation.
• Enable Azure Identity Protection

Lesson

• Application Management
• Identity Governance
• Manage device access
• Role Based Access Control (RBAC)
• Solutions for external access
• Privileged Identity Management

Lab: Use Conditional Access to enable MFA

• MFA Authentication Pilot (require MFA for specific apps)
• MFA Conditional Access (complete an MFA roll out)

Lab: Configure Privileged Identity Management

• Manage Azure resources
• Assign directory roles
• Activate and deactivate PIM roles
• Directory roles
• PIM resource workflows
• View audit history for Azure AD roles in PIM

After completing this module, students will be able to:

• Describe the concept of conditional access.
• Describe and use conditional access policies.
• Plan for device compliance.
• Configure conditional users and groups.
• Configure role based access control
• Describe the concepts of identity governance
• Configure and use Privileged Identity Management

Lesson

• Threat vectors and data breaches
• Security strategy and principles
• Microsoft security solutions
• Secure Score

Lab: Use Microsoft Secure Score

• Improve your secure score in the Microsoft 365 Security Center

After completing this module, students will be able to:

• Describe several techniques attackers use to compromise user accounts through email.
• Describe techniques attackers use to gain control over resources.
• List the types of threats that can be avoided by using EOP and Microsoft Defender for Office 365.
• Describe the benefits of Secure Score and what kind of services can be analyzed.
• Describe how to use Secure Score to identify gaps in your current Microsoft 365 security posture.

Lesson

• Exchange Online Protection (EOP)
• Microsoft Defender for Office 365
• Manage Safe Attachments
• Manage Safe Links
• Microsoft Defender for Identity
• Microsoft Defender for Endpoint

Lab: Manage Microsoft 365 Security Services

• Implement Microsoft Defender Policies

After completing this module, students will be able to:

• Describe the anti-malware pipeline as email is analyzed by Exchange Online Protection.
• Describe how Safe Attachments is used to block zero-day malware in email attachments and documents.
• Describe how Safe Links protect users from malicious URLs embedded in email and documents that point
• Configure Microsoft Defender for Identity.
• Configure Microsoft Defender for Endpoint.

Lesson

• Security dashboard
• Threat investigation and response
• Azure Sentinel
• Advanced Threat Analytics

Lab: Using Attack Simulator

• Conduct a simulated Spear phishing attack

After completing this module, students will be able to:

• Describe how Threat Explorer can be used to investigate threats and help to protect your tenant.
• Describe how the Security Dashboard gives C-level executives insight into top risks and trends.
• Describe what Advanced Thread Analytics (ATA) is and what requirements are needed to deploy it.
• Configure Advanced Threat Analytics.
• Use the attack simulator in Microsoft 365.
• Describe how Azure Sentinel can used for Microsoft 365.

Lesson

• Deploy Cloud Application Security
• Use cloud application security information

After completing this module, students will be able to:

• Describe Cloud App Security.
• Explain how to deploy Cloud App Security.
• Control your Cloud Apps with Policies.
• Use the Cloud App Catalog.
• Use the Cloud Discovery dashboard.
• Manage cloud app permissions.

Lesson

• Mobile Application Management (MAM)
• Mobile Device Management (MDM)
• Deploy mobile device services
• Enroll devices to Mobile Device Management

Lab: Device Management

• Enable Device Management
• Configure Azure AD for Intune
• Create compliance and conditional access policies

After completing this module, students will be able to:

• Describe mobile application considerations.
• Manage devices with MDM.
• Configure Domains for MDM.
• Manage Device Security Policies.
• Enroll devices to MDM.
• Configure a Device Enrollment Manager Role.

Lesson

• Information protection concepts
• Governance and Records Management
• Sensitivity labels
• Archiving in Microsoft 365
• Retention in Microsoft 365
• Retention policies in the Microsoft 365 Compliance Center
• Archiving and retention in Exchange
• In-place records management in SharePoint

Lab: Archiving and Retention

• Initialize compliance
• Configure retention tags and policies

After completing this module, students will be able to:

• Configure sensitivity labels.
• Configure archiving and retention in Microsoft 365.
• Plan and configure Records Management

Lesson

• Information Rights Management (IRM)
• Secure Multipurpose Internet Mail Extension (S-MIME)
• Office 365 Message Encryption

Lab: Configure Office 365 Message Encryption

• Configure Office 365 Message Encryption
• Validate Information Rights Management

After completing this module, students will be able to:

• Describe the various Microsoft 365 Encryption Options.
• Describe the use of S/MIME.
• Describe and enable Office 365 Message Encryption.

Lesson

• Data loss prevention fundamentals
• Create a DLP policy
• Customize a DLP policy
• Create a DLP policy to protect documents
• Policy tips

Lab: Implement Data Loss Prevention policies

• Manage DLP Policies
• Test MRM and DLP Policies

After completing this module, students will be able to:

• Describe Data Loss Prevention (DLP).
• Use policy templates to implement DLP policies for commonly used information.
• Configure the correct rules for protecting content.
• Describe how to modify existing rules of DLP policies.
• Configure the user override option to a DLP rule.
• Explain how SharePoint Online creates crawled properties from documents.

Lesson

• Compliance center

After completing this module, students will be able to:

• Describe how to use compliance score to make organizational decisions.
• Describe how assessments are used to determine compliance score.

Lesson

• Insider Risk
• Privileged Access
• Information barriers
• Building ethical walls in Exchange Online

Lab: Privileged Access Management

• Set up privileged access management and process a request

After completing this module, students will be able to:

• Explain and configure Insider Risk Management in Microsoft 365.
• Configure and approve privileged access requests for global administrators.
• Configure and use information barriers to conform to organizational regulations.
• Build ethical walls in Exchange Online
• Configure Customer Lockbox

Lesson

• Content Search
• Audit Log Investigations
• Advanced eDiscovery

Lab: Manage Search and Investigation

• Investigate your Microsoft 365 Data
• Conduct a Data Subject Request

After completing this module, students will be able to:

• Conduct content searches in Microsoft 365
• Perform and audit log investigation.
• Configure Microsoft 365 for audit logging.
• Use Advanced eDiscovery

This training prepares you for the Microsoft 365 Certified: Security Administrator Associate certification.