Cleared MS-500 last week at 847/1000 and wanted to share what worked since there's a lot of conflicting advice out there. I'm a security engineer with about four years of M365 experience, so I wasn't starting cold — but the breadth of the exam still surprised me. There's more Defender and Purview depth than I expected based on older resources I found online.
I studied for 7 weeks, roughly 90 minutes a day. The first three weeks were mostly Microsoft Learn content — I went through every learning path associated with the exam objectives. Weeks four and five I shifted to hands-on labs in a developer tenant, which I'd say made the biggest difference. You can read about Conditional Access policies all day but actually building them in the portal makes the exam questions way more intuitive.
The Defender for Office 365 section was heavy — probably 18-20% of my exam. Safe Links, Safe Attachments, anti-phishing policies, the difference between MDO Plan 1 and Plan 2 capabilities. If you're weaker on the Defender stack, spend real time there. Information barriers and Purview compliance features were also tested more than I anticipated based on the official skills outline.
Case study questions showed up and those were the hardest. You get a scenario, then 5-7 questions referencing that scenario, and you have to hold a lot of context in your head. I'd recommend practicing under time pressure since the full exam is 120 minutes and case studies eat into that faster than standalone questions.
847 is a great score. I passed at 762 and felt like the case studies almost sank me — the last one ate 22 minutes and I had to rush through the final standalone questions. Time management on case studies is a real skill, not just content knowledge.
The MDO Plan 1 vs Plan 2 distinction showed up on my exam at least four times in different forms. Knowing exactly which features require which license tier is worth drilling — Microsoft loves testing license boundaries on these exams. Easy points once you have them memorized.
The developer tenant advice is spot on. I failed my first attempt at 689 mostly because I'd only studied conceptually. Second attempt I spent two weeks doing hands-on configuration and passed at 791. The portal experience just makes the questions land differently.
Information barriers tripped me up too. I work in a shop that doesn't use them so I had basically zero hands-on exposure. Spent about 4 hours specifically on IB policies, segments, and how they interact with compliance boundaries. Those hours were worth it — I saw at least 3 questions on it.
Quick update for anyone following -- I've been grinding through practice tests this week and just hit 812 on a full MeasureUp sim, which honestly shocked me after bombing my first attempt at 680. The Defender for Endpoint and Purview compliance sections are finally clicking. Still shaky on some of the Conditional Access edge cases but it's getting there.
Planning to sit the real exam on July 8th. Your point about the breadth surprised me too -- I went in thinking my M365 admin background would carry me but there's way more depth expected than I anticipated. Two more weeks of focused review and I think I'll be ready. Thanks for posting this, it was way more useful than the generic "just read the docs" advice.
Congrats on the score! One thing that genuinely helped me was drilling the Defender for Endpoint side hard before the exam. I went through a lot of ms 500/questions/endpoint security device management practice questions and honestly that's where it clicked for me, because the exam loves to test conditional access alongside device compliance in the same scenario. It's not enough to know each piece in isolation.
The Purview stuff I knew would be there but the depth caught me off guard too. Don't underestimate sensitivity labels and DLP policy interactions, they came up more than I expected. You've clearly got the experience so just make sure you're not glossing over the "why" behind each policy decision, the exam really tests that reasoning.