SC-500 study plan

Define the shared responsibility model and explain how it shifts between on-premises, IaaS, PaaS, and SaaS

Distinguish authentication from authorization and give one example of each

Classify the three main identity types (human, workload, device) and map each to a Microsoft Entra object type

Describe defense-in-depth layers and identify which layer a given control belongs to

Explain Zero Trust principles and apply them to a hypothetical hybrid workforce scenario

Compare encryption at rest, in transit, and in use, naming one Microsoft service that provides each

Describe how Microsoft Entra ID differs from Active Directory Domain Services

Identify the components of the Microsoft cloud security benchmark and how it relates to compliance

Compare Entra ID editions (Free, P1, P2) and list which features each unlocks

Describe the purpose of Entra Domain Services and when to choose it over Entra ID

Explain the difference between security groups, Microsoft 365 groups, and administrative units

Configure and describe the effect of a self-service password reset policy conceptually

Explain authentication methods (password, FIDO2, certificate-based, Windows Hello for Business) and rank them by phishing resistance

Describe Conditional Access signal types, decisions, and the difference between report-only and enforced modes

Distinguish multifactor authentication from passwordless authentication with two examples each

Summarize how Identity Protection detects risk (user risk vs sign-in risk) and what remediation actions exist

Describe Privileged Identity Management: eligible vs active assignments, approval, and access reviews

Explain hybrid identity options (password hash sync, pass-through authentication, federation) and one trade-off of each

Describe how Entra ID Governance features (access reviews, entitlement management, lifecycle workflows) reduce standing access

Map an identity attack path (credential theft to lateral movement) and name the Entra control that breaks each step

Describe Microsoft Defender for Cloud secure score and how recommendations are prioritized

Compare the workload protections offered across Defender plans (servers, storage, databases, containers)

Explain Microsoft Defender XDR incident correlation and the difference between an alert and an incident

Describe Microsoft Sentinel data connectors, analytics rules, and automation rules at a conceptual level

Describe Microsoft Purview data classification: sensitive information types, trainable classifiers, and sensitivity labels

Explain how DLP policies, retention labels, and retention policies differ in intent and outcome

Summarize Insider Risk Management signals and the privacy safeguards built into it

Describe eDiscovery and audit capabilities, including how audit retention works

Describe the Microsoft Priva and Compliance Manager capabilities and how they support regulatory obligations

Reconcile the four domains into a single mental model linking identity, threat protection, and compliance

Complete a timed 50-question practice set and log every missed item by domain

Re-study the two weakest domains using the logged gaps only