Implement and manage identity and access (35–40%)
MS-500 part 1 Learning Path: Implement and manage identity and access
• Create, configure, and manage identities
• Explore identity synchronization
• Implement and manage hybrid identity
• Implement and manage external identities
• Explore password management in Microsoft 365
• Manage user authentication
• Plan, implement, and administer Conditional Access
• Plan and implement privileged access
• Plan and implement entitlement management
• Manage Azure AD Identity Protection

Implement and manage threat protection (25–30%)
MS-500 part 2 Learning Path: Implement and manage threat protection
• Implement Microsoft Defender for Identity
• Protect against threats with Microsoft Defender for Endpoint
• Detect and respond to security issues using Microsoft Defender for Endpoint
• Deploy the Microsoft Defender for Endpoint environment
• Protect against malicious attacks and unauthorized access with Microsoft Edge
• Reduce potential attack areas with Microsoft Defender for Endpoint
• Understand Microsoft 365 encryption
• Understand app management using Microsoft Endpoint Manager
• Manage device compliance
• Remediate risks with Microsoft Defender for Office 365
• Query, visualize, and monitor data in Microsoft Sentinel
• Implement Microsoft Cloud Application Security

Implement and manage information protection (10–15%)
MS-500 part 3 Learning Path: Implement and manage information protection
• Create and manage sensitive information types
• Apply and manage sensitivity labels
• Prevent data loss in Microsoft 365
• Manage data loss prevention policies and reports in Microsoft 365
• Govern information in Microsoft 365
• Manage data retention in Microsoft 365 workloads
• Manage records in Microsoft 365

Manage governance and compliance features in Microsoft 365 (20–25%)
MS-500 part 4 Learning Path: Manage Governance and Compliance Features in Microsoft 365
• Explore reporting in the Microsoft 365 security services
• Manage compliance in Microsoft 365 and Exchange Online
• Manage Advanced eDiscovery
• Explore Microsoft Compliance Manager
• Responding to Data Subject Requests (DSRs)
• Prepare communication compliance in Microsoft 365
• Manage insider risk in Microsoft 365
• Plan information barriers
• Implement privileged access management
• Manage Customer Lockbox