Microsoft 365 Certified Security Administrator Associate (1 科 Microsoft 365 商務雲端保安) 國際認可證書課程

The Microsoft 365 Security Administrator proactively secures Microsoft 365 enterprise environments, responds to threats, performs investigations, and enforces data governance.

The Microsoft 365 Security Administrator collaborates with the Microsoft 365 Enterprise Administrator, business stakeholders, and other workload administrators to plan and implement security strategies and ensures that the solutions comply with the policies and regulations of the organization.

Candidates for this certification are familiar with Microsoft 365 workloads and have strong skills and experience with identity protection, information protection, threat protection, security management, and data governance.

This role focuses on the Microsoft 365 environment and includes hybrid environments.

About Microsoft 365's Security services and certification

Microsoft 365 provides the following Security Capabilities which would be mentioned throughout our Cloud-focused Microsoft 365 Certified Security Administrator Associate training course:

• Azure AD authentication and synchronization options with Azure AD Connect
• Azure AD Multi-Factor Authentication (MFA) and Windows Hello
• Conditional Access
• Role Based Access Control
• Privileged Identity Management (PIM) & Azure AD Identity Protection
• Microsoft Defender for Identity and Microsoft Defender for Endpoint
• Microsoft Defender Application Guard and Application Control
• Microsoft Defender for Office 365 and Attack Simulator
• Windows and Non-Windows Device Encryption
• Azure Sentinel
• Office 365 Customer Lockbox
• Office 365 Collaboration and B2B External Sharing
• Sensitivity Labels and Policies
• Data Loss Prevention (DLP)
• Microsoft Cloud App Security
• Governance and Compliance features in Microsoft 365
• Microsoft Endpoint Manager Admin Center
• Microsoft 365 Security Center
• eDiscovery, investigation tools and Auditing
• Data privacy regulation compliance with GDPR
• Managing Data Subject Requests (DSRs)

Microsoft 365 Certified Security Administrator Associate

The Certification “Microsoft 365 Certified Security Administrator Associate” validates your capability to implement security controls and threat protection, manage identity and access, and protect data, applications, and networks in M365 cloud and hybrid environments as part of end-to-end infrastructure.

About the course

Our training course will guide you through carefully selected exam topics, along with real-life examples, practical demonstration and business cases of implementing, verifying and maintaining various Microsoft 365 Security features.

Evaluations, Pros and Cons and may be comparisons of different Microsoft 365 Security products would be verbally provided throughout the training course.

As Microsoft has been partnering with multiple 3^rd party vendor and built security-related ecosystems, it is inevitable that a small portion of the course time would be spent on briefly discussing popular partner security solutions.

Our senior instructor Mr. Larry Chan would give you advise, tricks and tips on various cloud security-related products.

課程名稱：	Microsoft 365 Certified Security Administrator Associate (1 科 Microsoft 365 商務雲端保安) 國際認可證書課程 - 簡稱：Microsoft 365 Security Administrator Training Course
課程時數：	24 小時 (共 8 堂，共 1 科)
適合人士：	有志考取 Microsoft 365 Certified Security Administrator Associate 證書人士; 或 有 Microsoft 365 商務雲端基本認識人士; 或 有少量 Microsoft 365使用經驗人士; 或 對雲端保安技術有興趣人士; 或 已修畢 Microsoft Certified 365 Fundamentals 課程 人士
授課語言：	以廣東話為主，輔以英語
課程筆記：	本中心導師親自編寫英文為主筆記，而部份英文字附有中文對照。

1. 模擬考試題目：	本中心為學員提供模擬考試題目，每條考試題目均附有標準答案。
2. 時數適中：	本中心的 Microsoft 365 Certified Security Administrator Associate (1 科 Microsoft 365 商務雲端保安) 國際認可證書課程時數適中，有 24小時。 令學員能真正了解及掌握課程內容，而又能於 3 個月內考獲以下 1 張國際認可證書： Microsoft 365 Certified Security Administrator Associate
3. 導師親自編寫筆記：	由本中心已擁有五項 MCITP，十多項 MCTS、MCSA 及 MCSE 資格，並有教授 Microsoft 相關課程 24 年以上經驗的資深導師 Larry Chan 親自編寫筆記，絕對適合考試及實際管理之用，令你無須「死鋤」如字典般厚及不適合香港讀書格調的書本。
4. 一人一機上課：	本課程以一人一機模式上課。
5. 免費重讀：	傳統課堂學員可於課程結束後三個月內免費重看課堂錄影。

Microsoft 已公佈考生只要通過以下 1 個 Microsoft 365 Security 相關科目的考試，便可獲發 Microsoft Certified Security Administrator Associate 國際認可證書：

考試編號	科目名稱
MS-500	Microsoft 365 Security Administration

本中心為Microsoft指定的考試試場。報考時請致電本中心，登記欲報考之科目考試編號、考試日期及時間 (最快可即日報考)。臨考試前要出示身份證及繳付每科 HK$1,025 之考試費。 考試題目由澳洲考試中心傳送到你要應考的電腦，考試時以電腦作答。所有考試題目均為英文，而大多數的考試題目為單項及多項選擇題。 考試合格後會收到來自Microsoft的作實電郵，並進入該電郵內的連結，登入 Microsoft Credentials Dashboard 下載您的證書。 考試不合格便可重新報考，不限次數。欲知道作答時間、題目總數、合格分數等詳細考試資料，可瀏覽本中心網頁 "各科考試分數資料"。

課程名稱：Microsoft 365 Certified Security Administrator Associate (1 科 Microsoft 365 商務雲端保安) 國際認可證書課程 - 簡稱：Microsoft 365 Security Administrator Training Course

MS-500 Microsoft 365 Security Administration (24 hrs)

1. Identity and Access Management in M365 Subscription
1.1 Creating and Managing Microsoft 365 for Business Subscription
1.2 Configuring Custom Domain Name for Microsoft 365
1.3 Creating Users and Assign licenses
1.4 Evolution of identity technology
1.4.1 Identity challenges
1.4.2 Identity is the new control plane
1.4.3 Identity governance process
1.5 Zero Trust Model
1.5.1 Zero Trust concepts
1.5.2 Zero Trust principles
1.5.3 Zero Trust components
1.6 Plan for a Zero Trust model
1.6.1 First step to enable a Zero Trust model—strong identity and access management
1.6.2 Zero Trust using Azure AD conditional access
1.6.3 Zero Trust networking
1.7 Plan your identity and authentication solution
1.7.1 Microsoft 365 identity models
1.7.2 Principal of Password Hash Synchronization
1.7.3 Monitoring AD Connect Synchronization Health
1.7.4 Azure AD Connect Sync Insight
1.7.5 Sync Latency
1.7.6 Sync Object Changes
1.7.7 Directory synchronization
1.7.8 Azure AD Connect cloud provisioning
1.8 Accounts and Roles
1.8.1 User identities
1.8.2 Creating users with Windows PowerShell
1.8.3 Manage user accounts and licenses
1.8.4 About Groups
1.9 Password Managment
1.9.1 Password Expiration
1.10 Introduction to Multi-factor authentication
1.10.1 Require MFA
1.10.2 Self-service password reset
1.10.3 Self-service password reset example
1.11 Password alternatives
1.11.1 Passwordless authentication with Azure AD
1.11.2 Microsoft Authenticator
1.11.3 Windows Hello for Business
1.12 Azure AD Smart Lockout
1.12.1 Verify On-premises Account Lockout Policy
1.12.2 Manage Azure AD Smart Lockout Values

2. Manage users with directory synchronization
2.1 Recovering a user account that was accidentally deleted
2.1.1 More about deleted Active Directory Objects
2.1.2 About Restoring on-premises Active Directory objects by Recycle Bin
2.1.3 Enabling the Active Directory Recycle Bin
2.1.4 Restoring Active Directory Objects
2.2 Recovering from unsynchronized deletes
2.3 Enhanced user management
2.3.1 Password writeback
2.3.2 Device writeback
2.4 Manage groups with directory synchronization
2.5 Azure AD Connect Sync Security Groups
2.6 Troubleshoot directory synchronization
2.6.1 Deactivate and Reactivate Directory Synchronization
2.6.2 View directory synchronization errors in the Microsoft 365 admin center
2.7 Unhealthy Identity Synchronization Notification
2.7.1 Synchronization Service Manager
2.7.2 Troubleshoot password hash synchronization with Azure AD Connect
2.8 Azure AD Identity Protection
2.8.1 Risk detection and remediation
2.8.2 Risk investigation
2.8.3 Detect vulnerabilities and risk events
2.8.4 Azure Active Directory risk events
2.8.5 Users with Leaked credentials
2.9 Plan your investigation
2.9.1 Mitigation sign-in risk events
2.9.2 Mitigation Best Practices
2.9.3 User risk
2.9.4 Closing risk events manually
2.9.5 Remediating user risk events
2.9.6 Azure Identity Protection notifications

3. Identity and Access Management
3.1 Introduction to Application Management
3.2 Improve productivity with SSO
3.2.1 Seamless Single Sign-On (SSO)
3.2.2 Key features of Seamless SSO
3.3 Azure AD App gallery
3.4 Azure AD application proxy
3.5 Secure hybrid access
3.6 Azure AD Identity Governance
3.6.1 Access lifecycle
3.6.2 Privileged access lifecycle
3.7 Conditional Access
3.7.1 Conditional access policies
3.7.2 Implementing cloud-based Azure Multi-Factor Authentication
3.7.3 Azure AD security defaults
3.7.4 Installing Microsoft Authenticator App
3.7.5 Testing Azure MFA
3.7.6 Configure Azure MFA Settings
3.7.7 Block and unblock users
3.7.8 Fraud Alert
3.7.9 Azure AD Sign-ins report
3.7.10 More about Security Defaults
3.7.11 Conditional access report-only mode
3.8 Managing Device Access
3.8.1 Plan for device compliance
3.8.2 Configure conditional users and groups
3.8.3 Create conditional access policies
3.8.4 Applying a conditional access policy
3.8.5 Conditional access with Intune
3.8.6 Monitor enrolled devices
3.9 Role Based Access Control (RBAC)
3.9.1 Plan for RBAC
3.9.2 Azure RBAC roles, and Azure AD administrator roles
3.9.3 Custom RBAC Roles
3.9.4 Azure AD B2B External Access solution
3.9.5 Office 365 external sharing and Azure AD B2B collaboration
3.9.6 Microsoft Teams external and guest access
3.10 Azure AD Priviliged Identiy Management
3.10.1 Enabling Azure AD Privileged Identity Management
3.10.2 Assigning Azure Resource Roles in PIM
3.10.3 Activating an Eligible resource role in Azure AD PIM
3.10.4 JIT Admin Access
3.10.5 Audit PIM
3.11 Microsoft Identity Manager (MIM)

4. Security in Microsoft 365
4.1 Threat vectors and data breaches
4.2 The workplace and threat landscape
4.3 Phishing
4.4 Spoofing
4.5 Spam and malware
4.6 Account breach
4.6.1 Mitigating an account breach
4.6.2 Elevation of privilege
4.7 Data exfiltration
4.8 Data deletion and spillage
4.8.1 Preventing data deletion
4.8.2 Data spillage
4.8.3 Preventing data spillage
4.9 Coin mining
4.9.1 How coin miners work
4.9.2 Examples of Coin Mining malware
4.10 Other attacks
4.10.1 Password cracking
4.10.2 Malicious insider
4.11 Security strategy and principles
4.11.1 Measuring security success
4.12 The defender's dilemma
4.13 Raise the attacker's cost
4.14 Microsoft Defender
4.14.1 Microsoft Defender for Office 365
4.14.2 Defender for Office 365 Policies
4.14.3 View Microsoft Defender for Office 365 reports
4.14.4 Automated Investigation and Response (AIR)
4.15 Microsoft Cloud Application Security
4.15.1 The Cloud App Security framework
4.16 Microsoft Defender for Endpoint
4.17 Microsoft Defender for Identity
4.17.1 Why use Microsoft Defender for Identity?
4.17.2 Monitor and profile user behavior and activities
4.17.3 Protect user identities and reduce the attack surface
4.17.4 Identify suspicious activities and advanced attacks across the cyber-attack kill-chain
4.18 Secure Score
4.18.1 Introduction to Secure score
4.18.2 How secure score works
4.18.3 Secure score dashboard
4.19 Improve your security posture

5. Threat Protection and Mitigation
5.1 Exchange Online Protection (EOP)
5.1.1 The anti-malware pipeline in Microsoft 365
5.2 Zero-hour auto purge (ZAP)
5.2.1 How ZAP works
5.2.2 Malware ZAP
5.2.3 Phish ZAP
5.3 Phishing and spoofing protection
5.3.1 Sender Policy Framework
5.3.2 Setting up SPF records for your domain
5.3.3 Domain Keys Identified Mail
5.3.4 Domain-based Messaging and Reporting Compliance
5.3.5 Spoof intelligence
5.4 Microsoft Defender for Office 365
5.4.1 Microsoft Defender for Office 365 expands on Exchange Online Protection
5.4.2 Safe Attachments
5.4.3 Safe Links
5.4.4 URL detonation
5.5 Microsoft Defender for Identity
5.5.1 Configure Microsoft Defender for Identity
5.5.2 Generate Microsoft Defender for Identity reports