Microsoft 365 Certified Security Administrator Associate (1 科 Microsoft 365 商務雲端保安) 國際認可證書課程
課程簡稱：Microsoft 365 Security Administrator Training Course

Microsoft 已更改產品 “Azure AD” 的名稱至新的名稱 “Entra ID” 以統一旗下產品的稱號。“Azure AD” 現有的理論、功能、角色、使用方法、應用程式開發介面 (API) 及指令集 (PowerShell cmdlets) 等等，將於新名稱 “Entra ID” 下保持不變。您於本課程學習 “Azure AD” 技術，將可以繼續於 “Entra ID” 下全數使用於日常工作並應考本課程相關的考試。Microsoft 亦有提及如果您的機構內已部署及正在使用 “Azure AD”，就算產品名稱被改成 “Entra ID”，您亦不需要採取任何行動，您的 I.T. 系統將會繼續運作，並會照樣地獲得與 “Azure AD” 相同的服務水準 (SLA，Service Level Agreement)。

資料來源:
https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/azure-ad-is-becoming-microsoft-entra-id/ba-p/2520436

關於本課程之相關考試：
Microsoft 已公佈將於 2023 年 6 月 30 日停止本課程的相關考試。

本中心是 Microsoft 認可的合作夥伴 (Microsoft Certified Partner)。

The Microsoft 365 Security Administrator proactively secures Microsoft 365 enterprise environments, responds to threats, performs investigations, and enforces data governance.

The Microsoft 365 Security Administrator collaborates with the Microsoft 365 Enterprise Administrator, business stakeholders, and other workload administrators to plan and implement security strategies and ensures that the solutions comply with the policies and regulations of the organization.

Candidates for this certification are familiar with Microsoft 365 workloads and have strong skills and experience with identity protection, information protection, threat protection, security management, and data governance.

This role focuses on the Microsoft 365 environment and includes hybrid environments.

About Microsoft 365's Security services and certification

Microsoft 365 provides the following Security Capabilities which would be mentioned throughout our Cloud-focused Microsoft 365 Certified Security Administrator Associate training course:

• Azure AD authentication and synchronization options with Azure AD Connect
• Azure AD Multi-Factor Authentication (MFA) and Windows Hello
• Conditional Access
• Role Based Access Control
• Privileged Identity Management (PIM) & Azure AD Identity Protection
• Microsoft Defender for Identity and Microsoft Defender for Endpoint
• Microsoft Defender Application Guard and Application Control
• Microsoft Defender for Office 365 and Attack Simulator
• Windows and Non-Windows Device Encryption
• Azure Sentinel
• Office 365 Customer Lockbox
• Office 365 Collaboration and B2B External Sharing
• Sensitivity Labels and Policies
• Data Loss Prevention (DLP)
• Microsoft Cloud App Security
• Governance and Compliance features in Microsoft 365
• Microsoft Endpoint Manager Admin Center
• Microsoft 365 Security Center
• eDiscovery, investigation tools and Auditing
• Data privacy regulation compliance with GDPR
• Managing Data Subject Requests (DSRs)

Microsoft 365 Certified Security Administrator Associate

The Certification “Microsoft 365 Certified Security Administrator Associate” validates your capability to implement security controls and threat protection, manage identity and access, and protect data, applications, and networks in M365 cloud and hybrid environments as part of end-to-end infrastructure.

About the course

Our training course will guide you through carefully selected exam topics, along with real-life examples, practical demonstration and business cases of implementing, verifying and maintaining various Microsoft 365 Security features.

Evaluations, Pros and Cons and may be comparisons of different Microsoft 365 Security products would be verbally provided throughout the training course.

As Microsoft has been partnering with multiple 3^rd party vendor and built security-related ecosystems, it is inevitable that a small portion of the course time would be spent on briefly discussing popular partner security solutions.

Our senior instructor Mr. Larry Chan would give you advise, tricks and tips on various cloud security-related products.

本中心為Microsoft指定的考試試場。報考時請致電本中心，登記欲報考之科目考試編號、考試日期及時間 (最快可即日報考)。臨考試前要出示身份證及繳付每科 HK$1,025 之考試費。

考試題目由澳洲考試中心傳送到你要應考的電腦，考試時以電腦作答。所有考試題目均為英文，而大多數的考試題目為單項及多項選擇題。

考試合格後會收到來自Microsoft的作實電郵，並進入該電郵內的連結，登入 Microsoft Credentials Dashboard 下載您的證書。

考試不合格便可重新報考，不限次數。欲知道作答時間、題目總數、合格分數等詳細考試資料，可瀏覽本中心網頁 "各科考試分數資料"。

MS-500 Microsoft 365 Security Administration (24 hrs)

1. Identity and Access Management in M365 Subscription
1.1 Creating and Managing Microsoft 365 for Business Subscription
1.2 Configuring Custom Domain Name for Microsoft 365
1.3 Creating Users and Assign licenses
1.4 Evolution of identity technology
1.4.1 Identity challenges
1.4.2 Identity is the new control plane
1.4.3 Identity governance process
1.5 Zero Trust Model
1.5.1 Zero Trust concepts
1.5.2 Zero Trust principles
1.5.3 Zero Trust components
1.6 Plan for a Zero Trust model
1.6.1 First step to enable a Zero Trust model—strong identity and access management
1.6.2 Zero Trust using Azure AD conditional access
1.6.3 Zero Trust networking
1.7 Plan your identity and authentication solution
1.7.1 Microsoft 365 identity models
1.7.2 Principal of Password Hash Synchronization
1.7.3 Monitoring AD Connect Synchronization Health
1.7.4 Azure AD Connect Sync Insight
1.7.5 Sync Latency
1.7.6 Sync Object Changes
1.7.7 Directory synchronization
1.7.8 Azure AD Connect cloud provisioning
1.8 Accounts and Roles
1.8.1 User identities
1.8.2 Creating users with Windows PowerShell
1.8.3 Manage user accounts and licenses
1.8.4 About Groups
1.9 Password Managment
1.9.1 Password Expiration
1.10 Introduction to Multi-factor authentication
1.10.1 Require MFA
1.10.2 Self-service password reset
1.10.3 Self-service password reset example
1.11 Password alternatives
1.11.1 Passwordless authentication with Azure AD
1.11.2 Microsoft Authenticator
1.11.3 Windows Hello for Business
1.12 Azure AD Smart Lockout
1.12.1 Verify On-premises Account Lockout Policy
1.12.2 Manage Azure AD Smart Lockout Values

2. Manage users with directory synchronization
2.1 Recovering a user account that was accidentally deleted
2.1.1 More about deleted Active Directory Objects
2.1.2 About Restoring on-premises Active Directory objects by Recycle Bin
2.1.3 Enabling the Active Directory Recycle Bin
2.1.4 Restoring Active Directory Objects
2.2 Recovering from unsynchronized deletes
2.3 Enhanced user management
2.3.1 Password writeback
2.3.2 Device writeback
2.4 Manage groups with directory synchronization
2.5 Azure AD Connect Sync Security Groups
2.6 Troubleshoot directory synchronization
2.6.1 Deactivate and Reactivate Directory Synchronization
2.6.2 View directory synchronization errors in the Microsoft 365 admin center
2.7 Unhealthy Identity Synchronization Notification
2.7.1 Synchronization Service Manager
2.7.2 Troubleshoot password hash synchronization with Azure AD Connect
2.8 Azure AD Identity Protection
2.8.1 Risk detection and remediation
2.8.2 Risk investigation
2.8.3 Detect vulnerabilities and risk events
2.8.4 Azure Active Directory risk events
2.8.5 Users with Leaked credentials
2.9 Plan your investigation
2.9.1 Mitigation sign-in risk events
2.9.2 Mitigation Best Practices
2.9.3 User risk
2.9.4 Closing risk events manually
2.9.5 Remediating user risk events
2.9.6 Azure Identity Protection notifications

3. Identity and Access Management
3.1 Introduction to Application Management
3.2 Improve productivity with SSO
3.2.1 Seamless Single Sign-On (SSO)
3.2.2 Key features of Seamless SSO
3.3 Azure AD App gallery
3.4 Azure AD application proxy
3.5 Secure hybrid access
3.6 Azure AD Identity Governance
3.6.1 Access lifecycle
3.6.2 Privileged access lifecycle
3.7 Conditional Access
3.7.1 Conditional access policies
3.7.2 Implementing cloud-based Azure Multi-Factor Authentication
3.7.3 Azure AD security defaults
3.7.4 Installing Microsoft Authenticator App
3.7.5 Testing Azure MFA
3.7.6 Configure Azure MFA Settings
3.7.7 Block and unblock users
3.7.8 Fraud Alert
3.7.9 Azure AD Sign-ins report
3.7.10 More about Security Defaults
3.7.11 Conditional access report-only mode
3.8 Managing Device Access
3.8.1 Plan for device compliance
3.8.2 Configure conditional users and groups
3.8.3 Create conditional access policies
3.8.4 Applying a conditional access policy
3.8.5 Conditional access with Intune
3.8.6 Monitor enrolled devices
3.9 Role Based Access Control (RBAC)
3.9.1 Plan for RBAC
3.9.2 Azure RBAC roles, and Azure AD administrator roles
3.9.3 Custom RBAC Roles
3.9.4 Azure AD B2B External Access solution
3.9.5 Office 365 external sharing and Azure AD B2B collaboration
3.9.6 Microsoft Teams external and guest access
3.10 Azure AD Priviliged Identiy Management
3.10.1 Enabling Azure AD Privileged Identity Management
3.10.2 Assigning Azure Resource Roles in PIM
3.10.3 Activating an Eligible resource role in Azure AD PIM
3.10.4 JIT Admin Access
3.10.5 Audit PIM
3.11 Microsoft Identity Manager (MIM)

4. Security in Microsoft 365
4.1 Threat vectors and data breaches
4.2 The workplace and threat landscape
4.3 Phishing
4.4 Spoofing
4.5 Spam and malware
4.6 Account breach
4.6.1 Mitigating an account breach
4.6.2 Elevation of privilege
4.7 Data exfiltration
4.8 Data deletion and spillage
4.8.1 Preventing data deletion
4.8.2 Data spillage
4.8.3 Preventing data spillage
4.9 Coin mining
4.9.1 How coin miners work
4.9.2 Examples of Coin Mining malware
4.10 Other attacks
4.10.1 Password cracking
4.10.2 Malicious insider
4.11 Security strategy and principles
4.11.1 Measuring security success
4.12 The defender's dilemma
4.13 Raise the attacker's cost
4.14 Microsoft Defender
4.14.1 Microsoft Defender for Office 365
4.14.2 Defender for Office 365 Policies
4.14.3 View Microsoft Defender for Office 365 reports
4.14.4 Automated Investigation and Response (AIR)
4.15 Microsoft Cloud Application Security
4.15.1 The Cloud App Security framework
4.16 Microsoft Defender for Endpoint
4.17 Microsoft Defender for Identity
4.17.1 Why use Microsoft Defender for Identity?
4.17.2 Monitor and profile user behavior and activities
4.17.3 Protect user identities and reduce the attack surface
4.17.4 Identify suspicious activities and advanced attacks across the cyber-attack kill-chain
4.18 Secure Score
4.18.1 Introduction to Secure score
4.18.2 How secure score works
4.18.3 Secure score dashboard
4.19 Improve your security posture

5. Threat Protection and Mitigation
5.1 Exchange Online Protection (EOP)
5.1.1 The anti-malware pipeline in Microsoft 365
5.2 Zero-hour auto purge (ZAP)
5.2.1 How ZAP works
5.2.2 Malware ZAP
5.2.3 Phish ZAP
5.3 Phishing and spoofing protection
5.3.1 Sender Policy Framework
5.3.2 Setting up SPF records for your domain
5.3.3 Domain Keys Identified Mail
5.3.4 Domain-based Messaging and Reporting Compliance
5.3.5 Spoof intelligence
5.4 Microsoft Defender for Office 365
5.4.1 Microsoft Defender for Office 365 expands on Exchange Online Protection
5.4.2 Safe Attachments
5.4.3 Safe Links
5.4.4 URL detonation
5.5 Microsoft Defender for Identity
5.5.1 Configure Microsoft Defender for Identity
5.5.2 Generate Microsoft Defender for Identity reports