Microsoft 365 Security Administration: MS-500 Exam Guide : Plan and Implement Security and Compliance Strategies for Microsoft 365 and Hybrid Environments

Cover......Page 1 Title Page......Page 2 Copyright and Credits......Page 3 About Packt......Page 5 Contributors......Page 6 Table of Contents......Page 8 Preface......Page 18 Section 1: Configuring and Administering Identity and Access in Microsoft 365......Page 24 Chapter 1: Planning for Hybrid Identity......Page 26 Planning your hybrid environment......Page 27 Synchronization methods with Azure AD Connect......Page 29 Password hash synchronization......Page 32 Pass-through authentication......Page 33 Federation......Page 34 Azure AD Seamless Single Sign-On......Page 37 Multi-factor authentication......Page 41 Self-service password reset......Page 42 Conditional Access......Page 44 Event monitoring and troubleshooting in Azure AD Connect......Page 45 Questions......Page 50 References......Page 52 Chapter 2: Authentication and Security......Page 54 Creating a dynamic group in Azure AD using the Azure portal......Page 55 Creating dynamic groups with Azure AD PowerShell......Page 59 Using group-based licensing in Azure AD......Page 62 Implementing Azure AD self-service password reset (SSPR)......Page 64 Setting up SSPR......Page 65 Using SSPR to reset passwords......Page 69 Combined registration for SSPR and MFA......Page 71 Implementing and managing Multi-Factor Authentication (MFA)......Page 72 Enabling MFA......Page 73 Configuring the secondary authentication method......Page 75 Performing an access review......Page 78 Summary......Page 81 Questions......Page 82 References......Page 84 Chapter 3: Implementing Conditional Access Policies......Page 86 Explaining Conditional Access......Page 87 Creating a simple Conditional Access policy......Page 89 Enhancing Conditional Access with Intune......Page 92 Device-based Conditional Access......Page 93 Creating a device-based Conditional Access policy......Page 94 Creating an app-based Conditional Access policy......Page 100 Monitoring Conditional Access events......Page 105 Questions......Page 107 References......Page 109 Chapter 4: Role Assignment and Privileged Identities in Microsoft 365......Page 112 Planning RBAC......Page 113 Configuring RBAC......Page 117 Monitoring RBAC......Page 123 Planning, configuring, and monitoring PIM......Page 125 Planning PIM......Page 126 Configuring PIM......Page 129 Monitoring PIM......Page 143 Questions......Page 146 References......Page 148 Chapter 5: Azure AD Identity Protection......Page 150 Understanding Identity Protection......Page 151 Configuring MFA registration policies......Page 158 Users at risk detected alerts......Page 161 Weekly digest......Page 163 Examining users at risk......Page 166 Examining risky sign-ins......Page 168 Examining risk detections......Page 169 Questions......Page 171 References......Page 173 Section 2: Implementing and Managing Threat Protection......Page 176 Chapter 6: Configuring an Advanced Threat Protection Solution......Page 178 Understanding suspicious activity......Page 179 Exploring advanced attacks and malicious activities......Page 180 Understanding the Azure ATP architecture......Page 181 Setting up an Azure ATP instance......Page 183 Additional configuration options......Page 191 The security alerts timeline in the Azure ATP portal......Page 193 Azure ATP reports......Page 195 The Azure ATP workspace health center......Page 201 Summary......Page 204 Questions......Page 205 References......Page 207 Chapter 7: Configuring Microsoft Defender ATP to Protect Devices......Page 208 Supported operating systems......Page 209 Implementing Microsoft Defender ATP......Page 210 Configuring Microsoft Defender ATP......Page 211 Attack surface reduction capabilities......Page 218 The Secure score dashboard......Page 221 Integrating with Azure ATP......Page 223 The Microsoft Defender Security Center settings......Page 224 Configuring Microsoft Defender Application Guard......Page 226 Configuring Microsoft Defender Application Control......Page 228 Configuring Microsoft Defender Exploit Guard......Page 230 Using WIP to configure WIP policies and protect data......Page 231 Introduction to BitLocker......Page 234 Summary......Page 237 Questions......Page 238 References......Page 240 Chapter 8: Message Protection in Office 365......Page 242 Protecting users and domains with ATP anti-phishing protection and policies......Page 243 Setting up an ATP anti-phishing policy......Page 244 Configuring Office 365 anti-spam protection......Page 253 Connection filter policy......Page 255 Outbound spam filter policy......Page 256 Exploring Office 365 ATP Safe Attachments options and policies......Page 258 Creating a Safe Attachments policy from the Security and Compliance Center......Page 259 Creating a Safe Attachments policy using Windows PowerShell......Page 261 Viewing or modifying the default Safe Links policy from the Security and Compliance Center......Page 263 Creating a new Safe Links policy from the Security and Compliance Center......Page 265 Creating a Safe Links policy using Windows PowerShell......Page 268 Questions......Page 269 References......Page 271 Chapter 9: Threat Intelligence and Tracking......Page 274 Understanding the Office 365 threat management security dashboard......Page 275 Threat protection status......Page 276 Insights......Page 278 Trends......Page 279 Using Office 365 Threat Explorer and threat trackers......Page 280 Using Threat Explorer......Page 281 Using threat trackers......Page 283 Managing quarantined messages and files......Page 285 Performing controlled simulated attacks......Page 289 Launching an attack......Page 290 Questions......Page 299 References......Page 301 Section 3: Information Protection in Microsoft 365......Page 302 Chapter 10: Controlling Secure Access to Information Stored in Office 365......Page 304 Understanding privileged access management......Page 305 Enabling PAM......Page 306 Submitting and approving PAM requests......Page 311 Enabling Customer Lockbox......Page 314 Responding to Customer Lockbox requests......Page 315 Protecting access to the collaboration components of Office 365......Page 316 Allowing external user access with B2B sharing......Page 320 Questions......Page 327 References......Page 329 Chapter 11: Azure Information Protection......Page 332 Planning and implementing an AIP deployment for your organization......Page 333 Checking AIP activation status using the Office 365 Admin Center......Page 334 Checking AIP activation status using the Azure portal......Page 335 Checking AIP activation status using the Azure AIPService PowerShell......Page 337 Configuring AIP superusers......Page 338 Setting up AIP labels and policies......Page 340 Setting up labels......Page 341 Setting up label policies......Page 350 Enabling Unified labeling......Page 355 User experience......Page 358 Installing the AIP Scanner......Page 359 Tracking and revoking protected documents......Page 362 Questions......Page 364 References......Page 366 Chapter 12: Data Loss Prevention......Page 368 Planning and implementing DLP......Page 369 Creating DLP policies and assigning them to Office 365 locations......Page 373 Testing your DLP policy......Page 381 Editing your DLP policy......Page 382 Managing sensitive information types......Page 384 DLP reporting and alerting capabilities......Page 390 Questions......Page 392 References......Page 394 Chapter 13: Cloud App Discovery and Security......Page 396 Understanding Cloud App Security......Page 397 Using built-in policies or creating custom policies to control SaaS app usage......Page 398 Configuring Cloud App Security......Page 399 Using the Cloud App Security dashboard, reports, and logs......Page 421 Questions......Page 426 References......Page 428 Section 4: Data Governance and Compliance in Microsoft 365......Page 430 Chapter 14: Security Analytics and Auditing Capabilities......Page 432 Desktop Analytics......Page 433 Windows diagnostics......Page 439 Office Telemetry......Page 441 Configuring Office 365 auditing......Page 442 Turning on the audit log......Page 444 Performing an audit log search......Page 445 Configuring an audit alert policy......Page 450 Summary......Page 456 Questions......Page 457 References......Page 459 Chapter 15: Personal Data Protection in Microsoft 365......Page 460 Conducting searches for personal data......Page 461 Using retention labels to protect personal data......Page 469 Data loss prevention reports......Page 475 Alert policies......Page 478 Microsoft Cloud App Security......Page 482 Summary......Page 486 Questions......Page 487 References......Page 488 Chapter 16: Data Governance and Retention......Page 490 Understanding data governance and the retention requirements for your organization......Page 491 Mailbox and public folder content......Page 492 Navigating data governance reports and dashboards......Page 493 Creating a retention policy using the Exchange admin center......Page 498 Creating a retention policy using the Security & Compliance Center......Page 502 Creating a supervision policy......Page 507 Litigation Hold......Page 516 Importing data into Office 365 from the Security & Compliance Center......Page 520 Configuring archiving......Page 528 Questions......Page 531 References......Page 533 Chapter 17: Search and Investigation......Page 536 eDiscovery cases......Page 537 Advanced eDiscovery......Page 538 eDiscovery delegated role groups......Page 539 Creating eDiscovery cases, placing locations on hold, and performing content searches......Page 546 Creating an eDiscovery case and placing locations on hold......Page 547 Performing a content search......Page 552 Exporting content search results......Page 554 Questions......Page 559 References......Page 561 Chapter 18: Data Privacy Compliance......Page 564 Phase 2 – after 90 days......Page 565 Phase 3 – ongoing......Page 566 Service Trust Portal......Page 567 Microsoft Compliance Score......Page 569 The GDPR dashboard and the GDPR toolbox......Page 574 Completing DSRs......Page 579 Summary......Page 583 Questions......Page 584 References......Page 586 Section 5: Mock Exam and Assessment......Page 588 Chapter 19: Mock Exam......Page 590 Overview......Page 594 Answers and explanations......Page 604 Chapter 1 – Planning for Hybrid Identity......Page 612 Chapter 2 – Authentication and Security......Page 613 Chapter 3 – Implementing Conditional Access Policies......Page 614 Chapter 4 – Role Assignment and Privileged Identities in Microsoft 365......Page 615 Chapter 5 – Azure AD Identity Protection......Page 616 Chapter 6 – Configuring an Advanced Threat Protection Solution......Page 617 Chapter 7 – Configuring Microsoft Defender ATP to Protect Devices......Page 618 Chapter 8 – Message Protection in Office 365......Page 619 Chapter 9 – Threat Intelligence and Tracking......Page 620 Chapter 10 – Controlling Secure Access to Information Stored in Office 365......Page 621 Chapter 11 – Azure Information Protection......Page 622 Chapter 12 – Data Loss Prevention......Page 623 Chapter 13 – Cloud App Discovery and Security......Page 624 Chapter 14 – Security Analytics and Auditing Capabilities......Page 625 Chapter 15 – Personal Data Protection in Microsoft 365......Page 626 Chapter 16 – Data Governance and Retention......Page 627 Chapter 17 – Search and Investigation......Page 628 Chapter 18 – Data Privacy Compliance......Page 629 Other Books You May Enjoy......Page 630 Leave a review - let other readers know what you think......Page 632 Index......Page 634 Synopsis Get up to speed with expert tips and techniques to help you prepare effectively for the MS-500 Exam Key Features Get the right guidance and discover techniques to improve the effectiveness of your studying and prepare for the exam Explore a wide variety of strategies for security and compliance Gain knowledge that can be applied in real-world situations Book Description The Microsoft 365 Security Administration (MS-500) exam is designed to measure your ability to perform technical tasks such as managing, implementing, and monitoring security and compliance solutions for Microsoft 365 environments. This book starts by showing you how to configure and administer identity and access within Microsoft 365. You will learn about hybrid identity, authentication methods, and conditional access policies with Microsoft Intune. Next, the book shows you how RBAC and Azure AD Identity Protection can be used to help you detect risks and secure information in your organization. You will also explore concepts, such as Advanced Threat Protection, Windows Defender ATP, and Threat Intelligence. As you progress, you will learn about additional tools and techniques to configure and manage Microsoft 365, including Azure Information Protection, Data Loss Prevention, and Cloud App Discovery and Security. The book also ensures you are well prepared to take the exam by giving you the opportunity to work through a mock paper, topic summaries, illustrations that briefly review key points, and real-world scenarios. By the end of this Microsoft 365 book, you will be able to apply your skills in the real world, while also being well prepared to achieve Microsoft certification. What you will learn Get up to speed with implementing and managing identity and access Understand how to employ and manage threat protection Get to grips with managing governance and compliance features in Microsoft 365 Explore best practices for effective configuration and deployment Implement and manage information protection Prepare to pass the Microsoft exam and achieve certification with the help of self-assessment questions and a mock exam Who this book is for This Microsoft certification book is designed to help IT professionals, administrators, or anyone looking to pursue a career in security administration by becoming certified with Microsoft's role-based qualification. Those trying to validate their skills and improve their competitive advantage with Microsoft 365 Security Administration will also find this book to be a useful resource.