1. Deploy and manage a Microsoft 365 tenant (25–30%)
Implement and manage a Microsoft 365 tenant
Create a tenant
Implement and manage domains
Configure org settings, including Security & privacy and Organization profile
Monitor the health of Microsoft 365 services by using Service Health, including configuration of notifications
Configure and review Network connectivity insights
Configure and monitor software updates by using the Microsoft 365 admin center
Monitor Microsoft 365 adoption and usage
Configure and manage Microsoft 365 Backup
Manage users and groups
Create and manage users in Microsoft Entra ID, including external users
Create and manage contacts in the Microsoft 365 admin center
Create and manage groups, including Microsoft 365 Groups and manage shared mailboxes
Manage and monitor Microsoft 365 licenses, including group-based licensing
Perform bulk user management, including Microsoft Graph PowerShell and Microsoft Entra PowerShell
Manage roles and role groups
Implement and manage roles in Microsoft 365 and Microsoft Entra ID
Manage permissions for Microsoft Defender XDR, Microsoft Purview and other Microsoft 365 workloads using roles or role groups
Manage delegation by using administrative units
Manage Microsoft Entra ID roles in Microsoft Entra Privileged Identity Management (PIM)
2. Implement and manage Microsoft Entra identity and access (25–30%)
Implement and manage identity synchronization with Microsoft Entra tenant
Prepare for identity synchronization, including IdFix
Implement and manage directory synchronization by using Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync
Monitor synchronization by using Microsoft Entra Connect Health
Troubleshoot synchronization, including Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync
Implement and manage authentication
Implement and manage authentication methods
Implement and manage self-service password reset (SSPR)
Implement and manage Microsoft Entra Password Protection
Investigate and resolve authentication issues
Implement and manage secure access
Plan for identity protection
Implement and manage Microsoft Entra Identity Protection
Plan Conditional Access policies
Implement and manage Conditional Access policies
Implement and manage multifactor authentication (MFA) by using Conditional Access policies
3. Manage security and threats by using Microsoft Defender XDR (30–35%)
Review and respond to security reports and alerts
Review and respond to threats by using Microsoft Security Exposure Management, including the Microsoft Secure Score
Review and respond to incidents and alerts generated by Microsoft Defender XDR, including advanced hunting
Review and respond to issues identified in Microsoft Defender XDR reports
Review and respond to threats identified by Microsoft Defender Threat Intelligence
Implement and manage email and collaboration protection
Implement threat policies and rules in Microsoft Defender for Office 365
Configure alert policies in Microsoft Defender for Office 365
Investigate and respond to email and collaboration threats by using Microsoft Defender for Office 365
Manage attack simulations, including training campaigns
Manage restricted entities, including blocked users
Implement and manage endpoint protection
Onboard devices to Microsoft Defender for Endpoint
Configure endpoint settings
Review and respond to vulnerabilities identified in the Microsoft Defender Vulnerability Management dashboard
Implement and manage Microsoft Defender for Cloud Apps
Configure the app connector for Microsoft 365
Configure Microsoft Defender for Cloud Apps policies, including triggering alerts
Interpret activity log
Configure Cloud App Discovery
Review and respond to issues identified in Cloud App Discovery
4. Manage compliance by using Microsoft Purview (10–15%)
Implement Microsoft Purview information protection and data lifecycle management
Implement and manage sensitive information types by using keywords, keyword lists, or regular expressions
Implement retention labels, retention label policies, and retention policies
Implement sensitivity labels and sensitivity label policies
Monitor label usage by using Content explorer, Activity explorer, and label reports
Implement Microsoft Purview data loss prevention (DLP)
Configure DLP policies for Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive, Teams, Power BI, and Microsoft 365 Copilot
Configure Endpoint DLP
Review and respond to DLP alerts, events, and reports
