Azure Security Engineer Learning Pathway
www.aka.ms/pathways
Getting Started
Azure Security Engineers implement security controls
and threat protection, manage identity and access,
and protect data, applications, and
networks in cloud and hybrid environments as part of
an end-to-end infrastructure.
Microsoft Learn
• New to the Cloud or Azure? Start with Azure
Fundamentals
• New to Security? Continue with Microsoft
Security, Compliance, and Identity Fundamentals
• Microsoft Trust Centre
• Compliance
• What is Azure Security Center?
• Azure Monitor – Security & Audit Dashboard
• Introduction to Azure security
• Introduction to key Azure network security
services
• Microsoft Security Blog
• Microsoft Security YouTube Channel
• Intro to data protection and privacy regulations
Doing More
• Threat Modeling Security Fundamentals
• Secure your infrastructure with threat modelling
• Protect identity and access with Azure Active
Directory
• Implement Windows Server IaaS VM Identity
• Secure your cloud data
• Architect secure infrastructure in Azure
• Azure security best practices and patterns
• Develop a security and compliance plan
• Safeguard multi-cloud apps and resources with
cloud security solutions from Microsoft
AZ-500: Microsoft Azure Security
Technologies Microsoft Official Practice Test
Manage identity and access:
• What is Azure Active Directory?
• Built-in roles for Azure Resources
• Create and manage users
• Create and manage groups
• Choose the right authentication method
for your Azure Active Directory hybrid
identity solution
• What is password hash synchronization
• Implement password hash synchronization
with Azure AD Connect sync
• Azure Active Directory Pass-through
Authentication: Technical deep dive
• Azure Active Directory Pass-through
Authentication: Quickstart
• Azure Active Directory pricing
• Create an Azure AD tenant and configure
registration for your application
• Azure Active Directory consent framework
• What are managed identities for Azure
resources?
• Protect against security threats on Azure
• Delegate access to Privileged Identity
Management
• Configure Azure AD role settings in
Privileged Identity Management
• Building a Conditional Access policy
• Assign Azure AD roles in Privileged Identity
Management
• What is Azure AD Multi-Factor
Authentication?
• Create an access review of groups and
applications in Azure AD access reviews
• Create an access review of Azure AD roles
in Privileged Identity Management
• What is Azure RBAC?
• Understand the difference between Azure
roles and Azure AD roles
• Create or update Azure custom roles using
the Azure portal
• Use resource locks to protect resources
Additional Study
Implement Platform Protection:
• Protect against security threats on Azure
• Use network security groups to control
network access
• Network security groups
• Create, change, or delete a network
security group
• Azure Firewall features
• Deploy and configure Azure Firewall
• What is Azure Web Application Firewall on
Azure Application Gateway?
• What is Azure Front Door?
• What is Azure Bastion?
• Tutorial: Configure Bastion and connect to
a Windows VM through a browser
• Secure network access to PaaS services
with virtual network service endpoints
• Endpoint protection assessment and
recommendations in Security Center
• Implement vulnerability management
• Update Management overview
• Add a TLS/SSL certificate in Azure App
Service
• Container security in Security Center
• Access and identity options for Azure
Kubernetes Service (AKS)
• Authenticate with an Azure container
registry
• Network concepts for applications in Azure
Kubernetes Service (AKS)
Manage Security Operations:
• Features of Azure Monitor logs
• Explore the different alert types that Azure
Monitor supports
• Create, view, and manage log alerts
• Configuring diagnostic logging and log
retention
• Monitor your security status with Security
Center recommendations
• Centralized policy management
• Manage security policies
• Vulnerability Scanner
• Exercise - Enable JIT VM access
• Tutorial: Protect your resources with Azure
Security Center
• What is Azure Sentinel?
• Tutorial: Detect threats out-of-the-box
• Sentinel - Connect data sources
• Automatically create incidents from
Microsoft security alerts
• Tutorial: Investigate incidents with Sentinel
• Use playbooks with automation rules
• What is Azure Policy?
• Tutorial: Create and manage policies to
enforce compliance
• Tutorial: Create a custom policy definition
• Tutorial: Create and manage policies to
enforce compliance
• What is Azure Blueprints?
• Create and assign blueprints
Secure Data and Operations:
• Azure Storage Overview
• Authorizing access to data in Azure Storage
• Delegate access with a shared access
signature
• Encryption
• What is Azure Key Vault?
• Key rotation
• Azure Key Vault security
• Quickstart: Create a key vault using the
Azure portal
• Create an Azure SQL Database baseline
• Server-level vs. database-level auditing
policy
• Create an Azure SQL Database baseline
• Azure Defender for SQL
• Authorize database access to SQL
Database, SQL Managed Instance, and
Azure Synapse Analytics
• Manage transparent data encryption
• Configure Always Encrypted by using Azure
Key Vault
Role Based Certification
Microsoft Certified: Azure Administrator Associate
Azure Administrator is a great complimentary certification for
Security Engineers. It is recommended but NOT mandatory.
Please see the Microsoft Azure Administrator Learning
Pathway for more information or
>>> Download Exam Skills Outline <<<
Role Based Certification
Microsoft Certified: Azure Security Engineer
Associate
AZ-500 Microsoft Azure Security Technologies
Skills measured
• Manage identity and access
• Implement platform protection
• Manage security operations
• Secure data and applications
>>> Download Exam Skills Outline <<<
• Secure your cloud applications in Azure
• Implement resource management security in Azure
• Implement network security in Azure
• Implement virtual machine host security in Azure
• Manage identity and access in Azure Active Directory
• Manage security operations in Azure
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a safer world for
all. Explore this library to find learning content relevant to
your needs
ACCESS
Azure security documentation
Security is integrated into every aspect of Azure. Click here
to find a comprehensive range of documentation covering
all aspects across all Azure services and more.
 Microsoft Security Operations Analyst
www.aka.ms/pathways
Getting Started
Microsoft:
• New to the Cloud or Azure? Start with
Azure Fundamentals
• New to Security? Continue with Microsoft
Security, Compliance, and Identity
Fundamentals
• What is Azure Sentinel?
• Microsoft Security YouTube Channel
• Azure Sentinel Blog
Cloud-native Security Operations
with Azure Sentinel
This learning path covers basic architecture,
core capabilities, and primary use cases of its
products.
Microsoft Learn:
• Introduction to Azure Sentinel
• Deploy Sentinel and connect data sources
• Threat detection with Sentinel analytics
• Security incident management in Sentinel
• Threat hunting with Azure Sentinel
• Threat response with Sentinel playbooks
• Query, visualize, and monitor data in
Sentinel
Microsoft Official Practice Test
Coming Soon
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a
safer world for all. Explore this library to find
learning content relevant to your needs
ACCESS
Mitigate threats using Microsoft 365 Defender:
• Learn about common threats
• Microsoft 365 Defender Suite
• Introduction to Microsoft Defender for Office
365
• Automate, investigate, and remediate
• Configure, protect, and detect
• Describe data loss prevention alerts
• Investigate data loss prevention alerts in
Microsoft 365 compliance
• Investigate data loss prevention alerts in
Microsoft Cloud App Security
• Insider risk management overview
• Introduction to managing insider risk policies
• Explain security operations in Microsoft
Defender for Endpoint
• Understand attack surface reduction
• Enable attack surface reduction rules
• Configure advanced features
• Configure alert notifications
• Manage custom detections
• Manage and investigate incidents
• Manage and investigate alerts
• Configure automated investigation and
remediation capabilities
• Explore vulnerabilities on your devices
• Understand threat intelligence concepts
• Track emerging threats with threat analytics
• Azure AD Identity Protection overview
• Detect risks with Azure AD Identity Protection
policies
• Building a Conditional Access policy
• Investigate and remediate risks detected by
Azure AD Identity Protection
• Microsoft Secure Score
• Create an access review of Azure AD roles in
Privileged Identity Management
• Azure Active Directory Identity Protection
notifications
• Introduction to Microsoft Defender for Identity
• Review compromised accounts or data
Additional Study
• Understand the Cloud App Security
Framework
• Classify and protect sensitive information
• Detect Threats
• Microsoft 365 Defender
• Manage incidents
• Use the action centre
• Hunt for threats across devices, emails, apps,
and identities
Mitigate threats using Azure Defender:
• Explain Azure Defender
• Explain Azure Security Center
• Enable Azure Defender
• Data collection, retention, and storage in
Application Insights
• Cloud workload protections in Azure Defender
• Explore and manage your resources with asset
inventory
• Configure auto provisioning
• Connect non-Azure resources to Azure
Defender
• Understand security alerts
• Manage security incidents in Security Center
• Manage security incidents and generate
threat intelligence reports
• Respond to alerts from Azure resources
• Remediate alerts and automate responses
• Automate responses to Security Center
triggers
• Explore Azure Resource Manager
• Structure and syntax of ARM templates
• Quickstart: Create an automatic response to a
specific security alert using an ARM template
Mitigate threats using Azure Sentinel:
• Define the concepts of SIEM, SOAR, XDR
• Describe how Sentinel provides integrated
threat protection
• Plan for the Azure Sentinel workspace
• Understand Sentinel permissions and role
• Configure log retention
• Archive data from Log Analytics workspace to
Azure storage using Logic App
• Log Analytics workspace data export in Azure
Monitor
• Azure security baseline for Azure Sentinel
• Connect data to Azure Sentinel using data
connectors
• Collect Syslog data sources with Log Analytics
agent
• Collect data from Linux-based sources using
syslog
•
Configure the log analytics agent
• Common Event Format connector
• Connect your external solution using the
Common Event Format connector
• Connect the Microsoft Office 365 connector
• Connect the Azure Active Directory connector
• Connect the Azure Active Directory identity
protection connector
• Plan for Windows hosts security events
connector
• Threat detection with Azure Sentinel analytics
• Threat response with Azure Sentinel playbooks
• Security incident management in Azure Sentinel
• Identify advanced threats with User and Entity
Behaviour Analytics (UEBA) in Azure Sentinel
• Monitor and visualize data
• Use default Azure Sentinel Workbooks
• •
Create a new Azure Sentinel Workbook
•
Explain threat hunting concepts in Azure Sentinel
• Explore creation and management of Azure
Sentinel threat-hunting queries
• Hunt for threats with Azure Sentinel
• Hunt by using bookmarks
• Keep track of data during hunting with Sentinel
• Use hunting livestream in Azure Sentinel
• Hunt with notebooks
• Create an Azure ML workspace
Role Based Certification
Microsoft Certified: Security Operations
Analyst
The Microsoft Security Operations Analyst
collaborates with organizational stakeholders to
secure information technology systems for the
organization. Their goal is to reduce organizational
risk by rapidly remediating active attacks in the
environment, advising on improvements to threat
protection practices, and referring violations of
policies to appropriate stakeholders.
Exam SC-200: Microsoft Security Operations
Analyst
Skills Measured:
• Mitigate threats using Microsoft 365 Defender
• Mitigate threats using Azure Defender
• Mitigate threats using Azure Sentinel
>>> Download Exam Skills Outline <<<
• Mitigate threats using Microsoft Defender for
Endpoint
• Mitigate threats using Microsoft 365 Defender
• Mitigate threats using Azure Defender
• Create queries for Azure Sentinel using Kusto
Query Language (KQL)
• Configure your Azure Sentinel environment
• Connect logs to Azure Sentinel
• Create detections and perform investigations
using Azure Sentinel
Perform threat hunting in Azure Sentinel
Check out the Azure Sentinel Learning
Companion for more learning resources
 Azure Sentinel Learning Companion
www.aka.ms/pathways
Getting Started
Microsoft:
• New to the Cloud or Azure? Start with
Azure Fundamentals
• New to Security? Continue with Microsoft
Security, Compliance, and Identity
Fundamentals
• What is Azure Sentinel?
• Microsoft Security YouTube Channel
• Azure Sentinel Blog
Cloud-native Security Operations
with Azure Sentinel
This learning path covers basic architecture,
core capabilities, and primary use cases of its
products. You'll also learn about differences
and get familiar with Azure Sentinel, a cloud-
native, security information and event
management (SIEM) service.
Microsoft Learn:
• Introduction to Azure Sentinel
• Deploy Sentinel and connect data sources
• Threat detection with Sentinel analytics
• Security incident management in Sentinel
• Threat hunting with Azure Sentinel
• Threat response with Sentinel playbooks
• Query, visualize, and monitor data in
Sentinel
Quickstarts/Tutorials
• Quickstart: On-board Azure Sentinel
• Quickstart: Get visibility into alerts
• Detect threats out-of-the-box
• Create custom analytics rules to detect
threats
• Visualize and monitor your data
• Investigate incidents
• Use playbooks with automation rules
• Create queries for Azure Sentinel using
Kusto Query Language (KQL)
Microsoft Docs & Reference
Learn More:
• Azure Sentinel documentation
• Azure Sentinel and Microsoft Teams
• Manage Sentinel workspaces at scale
• Cyber threat intelligence with Sentinel
• Useful resources for working with Sentinel
• Become an Azure Sentinel Ninja (from Sentinel
Blog)
• Azure Sentinel integration with Microsoft Cloud
App Security
• Build a scalable security practice with Azure
Lighthouse and Azure Sentinel
• Safeguard multi-cloud apps and resources with
cloud security solutions from Microsoft
• Defend against threats with Microsoft Threat
Protection
• Commonly used Azure Sentinel workbooks
Concepts:
• Classify and analyse data
• Permissions in Azure Sentinel
• Manage access to Sentinel data by resource
• Protecting MSSP intellectual property
• Advanced multistage attack detection
• Security Orchestration, Automation, and
Response (SOAR) in Sentinel
• Automation Rules for incident handling
• Advanced automation with playbooks
• Identify advanced threats with User and Entity
Behaviour Analytics (UEBA)
• Use SOC-ML anomalies to detect threats
• Import threat intelligence
• Threat intelligence integration
• Bring your own Machine Learning (ML) into
Azure Sentinel
• Microsoft 365 Defender integration with
Sentinel
• Use external data with watchlists
• Extend Azure Sentinel across workspaces and
tenants
Azure Sentinel Level 400 Ninja Training
The Azure Sentinel Level 400 Ninja Training Blog Post has been designed to help you become an Azure Sentinel
master. We’ve categorised the modules within the posting by job role to ensure the most appropriate learning
path for you. Check out the Ninja FAQ before starting
Sentinel Ninja
Everything you need to know and perhaps a little more….
• Module 1: Getting Started with Sentinel
• Module 2: How is Azure Sentinel used?
• Module 3: Workspace and tenant architecture
• Module 4: Data collection
• Module 5: Log Management
• Module 6: Enrichment: TI, Watchlists and more
• Module 7: Kusto Query Language (KQL)
• Module 8: Analytics
• Module 9: Implementing SOAR
• Module 10: Workbooks, reporting & visualization
• Module 11: Use cases and solutions
• Module 12: Handling incidents
• Module 13: Hunting
• Module 14: User and Entity Behaviour Analytics
• Module 15: Monitoring Azure Sentinel's health
• Module 16: Extending and Integrating using
Azure Sentinel APIs
• Module 17: Bring your own ML
SOC Analyst
Advanced use of Azure Sentinel including creating and
managing automation and threat intelligence
• Module 1: Getting Started with Sentinel
•
Module 10: Workbooks, reporting, and
visualization
• Module 11: Use cases and solutions
•
Module 12: Handling incidents
• Module 13: Hunting
• Module 14: User and Entity Behaviour Analytics
(UEBA)
Doing More
• Sentinel : Keep track of what's new
• Ask, or answer others on the Azure Sentinel
Tech Community
• Contribute or enhance rules, queries,
SOC Engineer workbooks, connectors and more to the
Basic use of Azure Sentinel including dealing with community on the Azure Sentinel GitHub
incidents and using dashboards
• Module 1: Getting Started with Sentinel
• Module 2: How is Azure Sentinel used?
• Module 3: Workspace and tenant architecture
• Module 4: Data collection
• Module 5: Log Management
• Module 6: Enrichment: TI, Watchlists, and more
• Module 7: Kusto Query Language (KQL)
• Module 8: Analytics
• Module 9: Implementing SOAR
• Module 10: Workbooks, reporting, and
visualization
• Module 15: Monitoring Azure Sentinel's health
• Module 16: Extending and Integrating using
Azure Sentinel APIs
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a safer
world for all. Explore this library to find
learning content relevant to your needs
ACCESS
 Microsoft Identity and Access Administrator
www.aka.ms/pathways
Getting Started
The Microsoft Identity and Access
Administrator designs, implements, and
operates an organization’s identity and access
management systems by using Azure Active
Directory (Azure AD).
Overview:
• Microsoft Security, Compliance, and
Identity Fundamentals
• Microsoft Security Site
• Manage Identity and Access in Azure AD
Zero Trust: Principals and Overview
• Microsoft Security YouTube Channel
• Playlist: Configuration and Management
• Playlist: Secure Remote Work
• Playlist: Manage and Integrate Apps
Securely
• Playlist: Identity and Access Management
• Azure AD Authentication Fundamentals
• Finding the Right Identity Strategy for Your
Organization with Azure AD
Microsoft Official Practice Test
Coming Soon
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a
safer world for all. Explore this library to find
learning content relevant to your needs
ACCESS
> Azure Active Directory Documentation <
Implement an identity management solution:
• Understand roles in Azure Active Directory
• Configure and manage Azure Active Directory
roles
• Add custom domain name to Azure Active
Directory
• Configure and manage custom domains
• Configure and manage device registration
• Administrative units in Azure Active Directory
• Configure delegation by using administrative
units
• Configuration in a tenant
• Configure tenant-wide setting
• Create, configure, and manage users
• Create and manage users
• Create, configure, and manage groups
• Create and manage groups
• Manage licenses
Implement and Manage External Identities:
• Manage external collaboration
• Manage external collaboration settings
• Invite external users
• Manage external user accounts
• Configure identity providers
Implement and Manage Hybrid Identity:
• Plan, design, and implement Azure Active
Directory Connect (AADC)
• Getting started with Azure AD Connect using
express settings
• What is password hash synchronization with
Azure AD?
• Implement manage password hash
synchronization (PHS)
• What is Azure Active Directory Pass-through
Authentication?
• Implement manage pass-through
authentication (PTA)
• Azure Active Directory Seamless Single Sign-On
• Implement and manage federation
Additional Study
Implement an Authentication and Access
Management Solution:
• What is Azure AD Multi-Factor
Authentication?
• Plan your multi-factor authentication
deployment
• Configure Azure AD Multi-Factor
Authentication settings
• Manage user authentication methods for
Azure AD Multi-Factor Authentication
Manage User Authentication:
• Passwordless authentication options
• Administer FIDO2 and passwordless
authentication methods
• Windows Hello for Business and
Authentication
• Implement an authentication solution based
on Windows Hello for Business
• Deploy SSPR (Self-Service Password Reset)
• Plan and deploy on-premises Azure Active
Directory Password Protection
• Deploy and manage password protection
• Use tenant restrictions to manage access to
SaaS cloud applications
• Implement and manage tenant restrictions
Manage Azure AD Identity Protection:
• Implement and manage user risk policy
• Enable user risk policy
• How To: Configure the Azure AD Multi-Factor
Authentication registration policy
• Monitor, investigate, and remediate elevated
risky users
Implement access management for apps:
• Configure how end-users consent to
applications
• Implement and configure consent settings
• Discover apps via MCAS and ADFS app report
• Design and implement app management
roles
• Monitor and audit access to Azure Active
Directory integrated applications
• Implement token customizations
• Integrate on-premises apps by using Azure
Active Directory application proxy
• Integrate custom SaaS apps for single sign-on
• Configure pre-integrated gallery SaaS apps
• What is app provisioning in Azure Active
Directory?
• Implement application user provisioning
Implement App Registrations:
• Plan your line of business application
registration strategy
• Configure application permission
• How to: Sign in any Azure Active Directory user
using the multi-tenant application pattern
Plan and Implement an Identity Governance
Strategy:
• Define a privileged access strategy for
administrative users
• Configure PIM for Azure Resources
• Approve or deny requests for AAD roles in PIM
• View audit history for Azure AD roles
• Manage emergency access accounts in AAD
Monitor and Maintain Azure Active Directory:
• Analyze and investigate sign-in logs
• Analyze Azure AD activity logs with Azure
Monitor logs
• How to use Azure Monitor workbooks for
Azure Active Directory reports
• Configure email notifications
Role Based Certification
Microsoft Certified: Identity and Access
Administrator
Exam SC-300: Microsoft Identity and Access
Administrator
>>> Download Exam Skills Outline <<<
Skills measured:
• Implement an identity management solution
• Implement an authentication and access
management solution
• Implement access management for apps
• Plan and implement an identity governance
strategy
Self Guided Learning:
• Implement an identity management solution
• Implement an Authentication and Access
Management solution
• Implement Access Management for Apps
• Plan and implement an identity governance
strategy
Microsoft Cloud Guides (Interactive)
• Enable a Combined MFA and SSPR Registration
Experience in Azure AD
• Enable Integrated Windows Authentication
to On-Premises Applications with Azure
AD Application Proxy
• Manage Guest User Access in Azure AD
for B2B Collaboration
• Integrate SaaS Applications with Azure AD
• Configure Conditional Access in Azure AD
• App Proxy—Integrated Windows
Authentication
• Azure AD Secure Hybrid Access with F5
• Enable B2B Collaboration in Azure AD
• Migrate to Cloud Authentication Using
Staged Rollout in Azure AD
• Enable Header-Based Authentication to
On-Premises Applications with Azure
AD Application Proxy
 Microsoft 365 Security Administrator
www.aka.ms/pathways
Getting Started
The Microsoft Identity and Access
Administrator designs, implements, and
operates an organization’s identity and access
management systems by using Azure Active
Directory (Azure AD).
Overview:
• Microsoft Security, Compliance, and
Identity Fundamentals
• Microsoft Security Site
• Manage Identity and Access in Azure AD
Zero Trust: Principals and Overview
• Microsoft Security YouTube Channel
• Playlist: Configuration and Management
• Playlist: Secure Remote Work
• Playlist: Manage and Integrate Apps
Securely
• Playlist: Identity and Access Management
• • Multi-factor authentication for Microsoft 365
Azure AD Authentication Fundamentals
• Finding the Right Identity Strategy for Your
Organization with Azure AD
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a
safer world for all. Explore this library to find
learning content relevant to your needs
ACCESS
Additional Study
> Microsoft 365 Documentation <
• Identity Protection policies
• User risk policy
Implement and manage identity and access:
• Sign-in risk policy
• Introduction to identity technology
• How to configure and enable risk policies
• Choose the right authentication method for
• Investigate risk
your hybrid identity solution
Implement and manage threat protection:
• Add or delete users using Azure Active Directory
• Learn about common threats
• Topologies for Azure AD Connect
• Understand the evolving threat landscape
• Hybrid identity and directory synchronization
• Microsoft Defender for Identity architecture
• Troubleshoot password hash synchronization
• Quickstart: Create your Microsoft Defender
with Azure AD Connect sync
for Identity instance
• Understand how identity is core to security
• Review compromised accounts or data
• Manage app and resource access using groups
• Create or update a dynamic group
• Microsoft Defender for Endpoint
• Configure and manage Microsoft Defender
• Eliminate bad passwords
for Endpoint capabilities
• Enforce on-premises Azure AD Password
• Microsoft Defender Application Guard
Protection for Active Directory Domain Services
• Application Control for Windows
• Be proactive with identity governance
• Protect devices from exploits
• Tutorial: Enable users to unlock their account or
• Secure boot
reset passwords using Azure Active Directory
• Device encryption in Windows 10
self-service password reset
• App protection policies overview
• Single sign-on options in Azure AD
• Microsoft Intune planning guide
• Seamless Single Sign-On
• Remediate risks with Microsoft Defender
• What is Azure Sentinel?
• Use the sign-ins report to review Azure AD
• Investigate incidents with Azure Sentinel
Multi-Factor Authentication events
Implement and manage information protection:
• Conditional Access: Require MFA for all users
• Manage Customer Lockbox
• What authentication and verification methods
• Microsoft 365 inter-tenant collaboration
are available in Azure Active Directory?
• What is guest user access in Azure Active
• Passwordless authentication options
Directory B2B?
• Enforce multi-factor authentication
• Azure Active Directory external Identities
• Conditional Access: Require compliant devices
• Govern access for external users
• Manage access to Azure management with
• Configure sensitivity labels
Conditional Access
• Configure sensitivity label policies
• Best practices for Azure RBAC
• Apply sensitivity labels to Microsoft Teams,
• Assign Azure roles using the Azure portal
Microsoft 365 groups, and SharePoint sites
• Audit logs in Azure Active Directory
• Monitor label performance using label
• Learn about just-in-time privileges
analytics
• Video: Configure PIM
• Data loss prevention reference
• Audit PIM
• Microsoft Information Protection
• Conditional Access: Conditions
• Sensitive information type entity definitions
• Define policy settings for your DLP policy
• View the reports for data loss prevention
• Email notifications / policy tips for DLP policies
• Microsoft Cloud App Security overview
• Get started with Microsoft Cloud App Security
• Control cloud apps with policies
• Set up Cloud Discovery
• App Connectors
• Managing API tokens
• Azure Information Protection integration
• Generic SIEM integration
• Video: Manage Alerts
• Generate data management reports
• Activity filters and queries
Manage governance and compliance features in
Microsoft 365:
• Manage devices with endpoint security in
Microsoft Intune
• Security Dashboard
• Microsoft Graph Security API overview
• Microsoft Secure Score
• Alert policies in the security and compliance
centre
• Auditing and reporting in Microsoft cloud
services
• Search the audit log
• Reports in the Security & Compliance Center
• Alert policies in the security compliance centre
• View the data governance reports
• Configure retention labels
• Create retention labels and apply them in apps
• Configure retention policies
• View label activity for documents
• Communication compliance
• In-Place Hold and Litigation Hold
• Delete or restore user mailboxes in Exchange
Online
• Archive third-party data
• Enable archive mailboxes in the compliance
centre
• Create and manage inactive mailboxes
• eDiscovery capabilities of Microsoft 365
•
Create a content search
• Configure permissions filtering for Content Search
• Microsoft 365 compliance centre
•
Microsoft Compliance Manager
• Build and manage assessments in Compliance
Manager
• General Data Protection Regulation Summary
•
Manage GDPR data subject requests with the DSR
case tool in the Security & Compliance Center
Role Based Certification
Microsoft 365 Certified: Security
Administrator
Exam MS-500: Microsoft 365 Security Administration
>>> Download Exam Skills Outline <<<
Skills measured:
• Implement and manage identity and access
• Implement and manage threat protection
• Implement and manage information protection
• Manage governance and compliance features in
Microsoft 365
Self Guided Learning:
• Protect identity and access with Azure Active
Directory
• Defend against threats with Microsoft Threat
Protection
• Protect enterprise information with Microsoft 365
• Manage security with Microsoft 365
• Manage insider risk in Microsoft 365
MS-500: Microsoft 365 Security
Administration Microsoft Official Practice
Test
 Microsoft Information Protection Administrator
www.aka.ms/pathways
Getting Started
The Information Protection Administrator
plans and implements controls that meet
organizational compliance needs. This person
is responsible for translating requirements and
compliance controls into technical
implementation. They assist organizational
control owners to become and stay compliant).
Overview:
• Microsoft Security, Compliance, and
Identity Fundamentals
• Be a Risk Management Hero
• Supercharge Information Protection
and Governance
• Don’t Lose Sleep Over Insider Risks
• Simplify and Extend Compliance
Beyond Microsoft 365
• Explore data governance in Microsoft 365
• Learn How Microsoft Safeguards Customer
Data
• Microsoft Security YouTube Channel
• Playlist: Information Protection and
Governance
• Playlist: Compliance Management
• Playlist: Discover & Respond
• Playlist: Insider Risk Management
Microsoft Official Practice Test
Coming Soon
Microsoft Security
Technical Content Library
Microsoft is committed to helping build a
safer world for all. Explore this library to find
learning content relevant to your needs
ACCESS
Implement Information Protection
Learn & Docs:
• Data classification overview
• Classify data using sensitive information types
• Review sensitive information and label usage
• Compare built-in versus custom sensitive
information types
• Exact data match-based (EDM-based)
classification
• Implement document fingerprinting
• Create keyword dictionary
• Classify data using trainable classifiers
• Types of classifiers
• Configure a custom trainable classifier
• Configure sensitivity labels
• Configure sensitivity label policies
• Configuring secure document collaboration by
using Azure Information Protection
• Configure auto-labelling policies
• Apply sensitivity labels to Microsoft Teams,
Microsoft 365 groups, and SharePoint sites
• Tutorial: Preventing oversharing in Outlook
using Azure Information Protection (AIP)
• Apply protections and restrictions to email and
files
• Monitor label performance using label analytics
• Plan on-premises labelling
• Message encryption
• Implement Office 365 message encryption
• Implement Office 365 advanced message
encryption
Blogs
• Microsoft Security Blog
• Microsoft 365 Blog
• Microsoft Azure Blog
Skills Measured
Implement Data Loss Prevention
Learn & Docs:
• Data loss prevention overview
• Configure data loss prevention for policy
precedence
• Azure Information Protection integration
• Configure file policies in Microsoft Cloud App
Security
• Implement data loss prevention policies in
test mode
• Define policy settings for your DLP policy
• Create, test, and tune a DLP policy
• Review and analyse data loss prevention
reports
• Manage permissions for data loss prevention
reports
• Manage and respond to data loss prevention
policy violations
• Manage DLP violations in Microsoft Cloud
App Security
• Manage device security with endpoint
security policies in Microsoft Intune
• Using Endpoint data loss prevention
• Get started with Endpoint data loss
prevention
• Learn about Microsoft 365 Endpoint data loss
prevention
Implement Information
Governance
Learn & Docs:
• Information governance overview
• Configure retention policies
• Create and configure retention policies
• Configure retention labels
• Configure auto-apply retention label policies
• Explain retention in Exchange Online
• Explain retention in SharePoint Online and
OneDrive for Business
• Explain retention in Microsoft Teams
• Recover content in Microsoft 365 workloads
• Implement retention policies and tags in
Microsoft Exchange
• Apply mailbox holds in Microsoft Exchange
• Recover content in Microsoft Exchange
• Records management overview
• Use file plan to manage retention labels
• Create retention labels and apply them in apps
• Import a file plan
• Start retention when an event occurs
Role Based Certification
Microsoft Certified: Information Protection
Administrator
Exam SC-400: Microsoft Information Protection
Administrator
>>> Download Exam Skills Outline <<<
Skills measured
• Implement information protection
• Implement data loss prevention
• Implement information governance
• Implement Information Protection
• Implement Data Loss Prevention
• Implement Information Governance
Microsoft Cloud Guides (Interactive)
• Protect Sensitive Data with Information
Protection
• Minimize: Internal Risks | Communication
Risks
• Implement Privileged Access Management
Doing More
• Manage Information Protection & Governance
• Intro to Microsoft data classification and data
protection
• Manage data governance in Microsoft 365
• Implement data governance in Microsoft 365
intelligence
• Reduce Risk with Microsoft Compliance
Manager
• Implement compliance solutions
• Security and Compliance
• Advanced eDiscovery and Advanced Audit
• Manage Insider Risk in Microsoft 365
• 3 ways to build a strong security culture to
reduce insider risk