Cleared MS-500 last week at 847/1000 and wanted to share what worked since there's a lot of conflicting advice out there. I'm a security engineer with about four years of M365 experience, so I wasn't starting cold — but the breadth of the exam still surprised me. There's more Defender and Purview depth than I expected based on older resources I found online.
I studied for 7 weeks, roughly 90 minutes a day. The first three weeks were mostly Microsoft Learn content — I went through every learning path associated with the exam objectives. Weeks four and five I shifted to hands-on labs in a developer tenant, which I'd say made the biggest difference. You can read about Conditional Access policies all day but actually building them in the portal makes the exam questions way more intuitive.
The Defender for Office 365 section was heavy — probably 18-20% of my exam. Safe Links, Safe Attachments, anti-phishing policies, the difference between MDO Plan 1 and Plan 2 capabilities. If you're weaker on the Defender stack, spend real time there. Information barriers and Purview compliance features were also tested more than I anticipated based on the official skills outline.
Case study questions showed up and those were the hardest. You get a scenario, then 5-7 questions referencing that scenario, and you have to hold a lot of context in your head. I'd recommend practicing under time pressure since the full exam is 120 minutes and case studies eat into that faster than standalone questions.
847 is a great score. I passed at 762 and felt like the case studies almost sank me — the last one ate 22 minutes and I had to rush through the final standalone questions. Time management on case studies is a real skill, not just content knowledge.
The MDO Plan 1 vs Plan 2 distinction showed up on my exam at least four times in different forms. Knowing exactly which features require which license tier is worth drilling — Microsoft loves testing license boundaries on these exams. Easy points once you have them memorized.
The developer tenant advice is spot on. I failed my first attempt at 689 mostly because I'd only studied conceptually. Second attempt I spent two weeks doing hands-on configuration and passed at 791. The portal experience just makes the questions land differently.
Information barriers tripped me up too. I work in a shop that doesn't use them so I had basically zero hands-on exposure. Spent about 4 hours specifically on IB policies, segments, and how they interact with compliance boundaries. Those hours were worth it — I saw at least 3 questions on it.
Quick update for anyone following -- I've been grinding through practice tests this week and just hit 812 on a full MeasureUp sim, which honestly shocked me after bombing my first attempt at 680. The Defender for Endpoint and Purview compliance sections are finally clicking. Still shaky on some of the Conditional Access edge cases but it's getting there.
Planning to sit the real exam on July 8th. Your point about the breadth surprised me too -- I went in thinking my M365 admin background would carry me but there's way more depth expected than I anticipated. Two more weeks of focused review and I think I'll be ready. Thanks for posting this, it was way more useful than the generic "just read the docs" advice.
Congrats on the score! One thing that genuinely helped me was drilling the Defender for Endpoint side hard before the exam. I went through a lot of ms 500/questions/endpoint security device management practice questions and honestly that's where it clicked for me, because the exam loves to test conditional access alongside device compliance in the same scenario. It's not enough to know each piece in isolation.
The Purview stuff I knew would be there but the depth caught me off guard too. Don't underestimate sensitivity labels and DLP policy interactions, they came up more than I expected. You've clearly got the experience so just make sure you're not glossing over the "why" behind each policy decision, the exam really tests that reasoning.
I can relate to this so much — I failed my first attempt at 780 and honestly didn't see it coming. What killed me was Defender for Endpoint. I thought I understood it but the exam goes really deep on device management and I wasn't prepared for how granular it gets. Second time around I drilled that whole area hard, especially compliance policies and conditional access edge cases. I even went through ms 500/questions/endpoint security device management 3 multiple times because it exposed gaps I didn't know I had.
The Purview stuff caught me off guard too on both attempts, but I did better on it the second time just from more hands-on time in the portal. Congrats on the 847, that's a solid score. If anyone's prepping now, don't underestimate how much Defender they'll throw at you.
Congrats on the score! I'm a working parent with a full-time sysadmin job so I had maybe 45 minutes a night, sometimes less. What actually helped me was drilling question sets back-to-back rather than re-reading docs I'd already skimmed. I spent a solid week on this ms 500/questions/endpoint security device management 3 set because endpoint stuff kept tripping me up and honestly it clicked once I just did the questions over and over until I understood the why behind each one.
The breadth thing you mentioned is real. I didn't fully appreciate how much Purview was on there until about two weeks out and had to scramble a bit. If you're studying part-time I'd say don't spread yourself too thin trying to cover everything equally — figure out your weak spots early and just live in those sections for a while. It's not glamorous but it works.