Domain 1: Plan the architecture and solution design
- The cloud deployment depends on Azure services, and the on-premises option deliberately does without them. Dual-write with Dataverse and cloud servicing through Lifecycle Services are the capabilities most often missed when a project chooses on-premises.
- A model is the unit of ownership and delivery, and every Application Object Tree element belongs to exactly one. References between models are what make an extension able to see the elements it customises, and a missing reference is the usual cause of an element that cannot be found at compile time.
- A deployable package carries compiled models and is applied to an environment through Lifecycle Services. Source lives in version control, configuration moves through data entities and process data packages, and data moves through a refresh; none of the three travel together.
- Each environment has its own database, which is exactly what makes a sandbox safe to break and refresh. Behaviour that differs between environments almost always means something reached one of them outside the deployment pipeline.
- The promotion path runs check-in, automated build, upload to the asset library, deployment to a sandbox that resembles production, then production. Every step provides a guarantee, and skipping one removes it.
- Lifecycle Services holds environments, asset libraries, Issue Search and servicing, while Azure DevOps holds source, branches and work items. Knowing which tool answers which question saves a great deal of searching.
- The Unified Developer Experience puts developer environments inside Power Platform, managed from the Power Platform admin center, while Visual Studio remains the development tool. The Implementation portal tracks phases, milestones and Microsoft's success reviews.
- Issue Search should be the first stop when standard behaviour looks wrong, since a great deal of investigation time is spent on issues Microsoft has already documented and fixed.
- Extensions are the only supported customisation model. Anything that depends on internals Microsoft has not marked extensible is what breaks at the next platform update.
Domain 2: Apply developer tools
- Application Explorer browses the metadata every referenced model exposes; Team Explorer covers version control and work items; Test Explorer discovers and runs tests. Each window answers a different question.
- A Visual Studio project belongs to exactly one model and gathers the elements a developer is working on. Several projects can target the same model, and the model rather than the project is what ships.
- Metadata changes to tables are invisible to the runtime until the database is synchronised with the data dictionary. A field that exists in the designer and nowhere else is almost always an unsynchronised database.
- Standard elements are read only. The response to a read only element is an extension from the developer's own model rather than any attempt to make it editable.
- Best practice checks catch naming, structure and extensibility problems while they are cheap to fix. An extensibility warning is a defect in waiting rather than noise to suppress.
- Team Foundation Version Control uses check out, changeset and workspace; Git is distributed with local history. Both are hosted in Azure DevOps and both hold X++ perfectly well.
- Branch to isolate a line of work such as a live release, and merge frequently so each merge stays small. A branch that is never merged has become a fork.
- Associating a changeset with a work item is what turns a list of file edits into history that explains itself years later.
- Continuous integration means an automated build on check-in that runs the tests; continuous delivery means that build's package is deployed without manual steps. A gated check-in makes the build a precondition rather than a consequence.
- Labels in version control mark exactly which file versions made up a release, which is what allows a production problem to be reproduced from the code that was actually running.
Domain 3: Design and develop AOT elements
- Form patterns give the application a consistent shape and are checked by the compiler. Details master pairs a list with the selected record's detail; simple list suits reference data; dialogs gather parameters.
- Form extensions add controls, data sources and parts, and code hides what must not appear. Deleting a standard control and changing a form's pattern are both outside what an extension may do.
- Data source events cover the record lifecycle. The validating event can still prevent a value being accepted; the validated event runs after it has been. Choosing the wrong one produces a rule that never prevents anything.
- Display methods compute a value for presentation and are evaluated far more often than developers expect. Caching one is a single property change with a large effect in a grid.
- Menu items come in display, action and output flavours, referencing a form, a class and a report respectively. Security is granted on the menu item rather than on the object it opens.
- Labels separate wording from code so the same element can be presented in several languages. Hard coded user facing strings are flagged by best practice rules for exactly that reason.
- Extended data types define a primitive with shared label, length and relations, so a change reaches every derived field. Base enums are fixed at compile time, which is why anything users maintain belongs in a table instead.
- Table extensions add fields, indexes, field groups and relations. They never change an existing field's type and never remove anything, which is what keeps standard code working.
- Delete actions express referential behaviour declaratively, the CacheLookup property decides how aggressively records are cached, and SaveDataPerCompany decides whether a table is company specific.
- Views are read only elements over a query and can carry computed columns evaluated by the database. Maps give several structurally similar tables shared field names and shared method implementations.
- Data entities are denormalised projections used for import, export and OData. The natural key is the most consequential decision on any entity, since it determines whether a repeated import updates or duplicates.
- Class extensions augment a class in place, adding members and wrapping methods through Chain of Command. Event handlers are static methods subscribed with an attribute, and delegates are publication points that couple most loosely of all.
Domain 4: Develop and test code
- A select statement inside a loop issues one query per outer row and is the single most common cause of X++ code that passes testing and fails in production. A join or a set based statement is almost always the answer.
- Set based operations push work into the database, and they fall back to row by row where the table carries per record logic. Knowing when the fallback happens is what makes their performance predictable.
- Exists and notexists joins express that only the presence or absence of a related row matters, which lets the database stop looking as soon as it knows the answer.
- A transaction block makes multi statement work atomic. An exception inside it rolls everything back and propagates outward, which is why a catch belongs outside the block rather than inside it.
- Chain of Command wrappers must call next so that several extensions can layer on one method. Omitting next breaks the chain for every other extension and is a defect rather than a technique.
- Pre and post event handlers see the arguments and the result respectively. Where the publisher has provided a delegate, subscribing to it is preferable to wrapping.
- Attributes are metadata the framework reads: subscribing a handler to an event, or declaring which case an implementation handles so a factory can resolve it without a switch that nobody can edit.
- The SysOperation framework separates the data contract holding parameters, the controller deciding how and where the operation runs, and the service containing the business logic. That separation is what makes the logic testable and reusable.
- The workflow framework needs a workflow type, submit and outcome handler classes, and a status field on the document. Posting or notification belongs in the completed outcome handler rather than in a table method or a polling job.
- Batch jobs run under a different user in a session with no person present, so anything that reads the current context or expects a dialog behaves differently. Long jobs should divide into independent tasks and be safe to rerun.
- SysTest test classes derive from a base class and mark methods with the test attribute. Setup prepares the state each test needs, tests create their own data, and assertions are what make a test able to fail.
- A test that passes alone and fails in the suite depends on state another test leaves behind. Intermittent failures almost always indicate a genuine race or shared state problem rather than a flaky test.
Domain 5: Implement reporting
- SQL Server Reporting Services produces the business documents that need an exact layout, with precision designs for invoices and similar output and auto designs for listings.
- A report reads either a query, where the requirement can be expressed declaratively, or a report data provider that runs logic and fills temporary tables. Choosing the query where it works keeps the report maintainable.
- The contract class holds the report's parameters, which the framework turns into a dialog and the provider reads to select data. Filtering in the provider rather than at render time avoids producing rows nobody sees.
- Standard report designs are duplicated into a customer model and the menu item is pointed at the copy. The cost is that later standard improvements have to be merged deliberately.
- Print management holds destination, copies and conditions per document and party, which is how a confirmation reaches the right address without anyone acting.
- Aggregate measurements model measures and dimensions for analytical consumption and are deployed to the entity store, then refreshed. A newly created measurement returns nothing until both steps are done.
- Power BI and analytical workspaces read the analytical store rather than the transactional tables, which is what keeps heavy queries away from the people entering orders.
- The Excel add-in reads and writes through the same data entities the application uses, so what a user types is validated exactly as it would be in the application.
- Electronic reporting holds a model, a model mapping and a format as configuration, so a jurisdiction's changed file layout is a configuration update rather than a development project.
- Reports are secured through a privilege on their output menu item, and extensible data security applies to their data, so two users can legitimately produce different totals from the same report.
Domain 6: Integrate and manage data solutions
- Synchronous calls suit small operations where somebody is waiting; asynchronous patterns suit volume and anything that does not need an immediate answer. Choosing deliberately rather than by habit is what the integration questions test.
- OData over public entities suits on demand reads of moderate volume, the package based recurring integration API suits scheduled bulk movement, custom services expose operations rather than records, and business events notify without polling.
- Reading the application database directly is unsupported however it is justified, because it bypasses validation and security and depends on a schema Microsoft does not guarantee.
- Idempotency matters because at least once delivery is normal. Matching on a natural key the source can actually supply is what turns a repeated message into a harmless update rather than a duplicate.
- A data project holds the entities, the files, the sequencing and the field mapping for an import or export. Parents must be sequenced before children, and rows land in staging where they are validated before reaching the target tables.
- Failed rows stay in staging with their errors so they can be corrected and reprocessed without the sender being involved again. Change tracking on an entity is what makes an incremental export practical.
- Composite entities import a header with its lines as one document; aggregate entities expose summarised data for analytics. Both are distinct from an ordinary entity over one or more tables.
- Dual-write keeps records synchronised in both systems in near real time, while virtual entities project application data into Dataverse without any copy. The choice is between resilience and currency.
- Business events are delivered to endpoints such as a service bus or a Power Automate flow, and secrets used by outbound calls belong in Azure Key Vault so they can be rotated without a deployment.
- An exposed entity or service contract is an agreement with whoever consumes it. Removing a field, changing a key or renaming an OData collection is a breaking change that needs coordinating.
Domain 7: Implement security and optimize performance
- Security runs from roles that users are assigned, through duties describing tasks, to privileges that grant entry points. Privileges inherit the table and field permissions the referenced object needs, which is what keeps the model correct as the application changes.
- Access levels are graduated from read through to delete and correct, so least privilege is expressed by granting the lowest level the task requires. Roles accumulate as people change jobs, which is why periodic review matters.
- Segregation of duties rules encode the combinations one person should not hold. A detected conflict is resolved by changing the assignment or recording an approved exception, never by deleting the rule.
- Extensible data security restricts which records a user may see through a policy joining a permitting query to the constrained tables. It applies wherever the data is read, including in reports.
- Table caching removes round trips for small, stable, frequently read tables and is the wrong answer for large volatile ones. The global cache and singleton patterns follow the same principle for computed values.
- Selecting only the fields the code uses reduces transfer, but a partially populated buffer written back can empty the fields it never read.
- Temporary tables give code somewhere to assemble intermediate results, with in memory tables suiting modest sets and database backed ones suiting large volumes.
- Optimistic concurrency lets reads proceed unblocked and detects the collision at write time. A reread and retry is the normal handling rather than a workaround.
- Transaction length drives contention, so preparation belongs before the block and anything waiting on a person or another system belongs outside it entirely.
- An index speeds up matching reads and costs on every write, so the decision depends on how the table is used. A function around an indexed field, or a leading wildcard, prevents the index being used at all.
- Measure before optimising: capture a trace, read it in Trace Parser, change what it identified, and measure again. Unmeasured optimisation usually improves something that took no time.
- An optimisation that changes behaviour is a defect rather than an improvement, which is why tests matter as much during performance work as during any other change.
MB-500 exam tips
- Learn which mechanism answers which question, because a large share of MB-500 items reduce to that choice. Chain of Command wraps a method and must call next, an event handler reacts before or after it, a delegate is the publisher's own extension point, and a subclass affects nothing that already exists.
- Assume every question about changing standard behaviour has an answer inside the extension model. Copying a standard class, modifying the application suite, omitting the call to next, and reading the database directly are wrong answers wherever they appear.
- For X++ performance, look first for a query inside a loop and second for work done per row that could be done per set. Those two account for most of the code that is fast in testing and unusable in production.
- Know the two step import: rows land in staging, are validated, and then move to the target tables. Almost every data management question turns on that arrangement, on the natural key, or on the field mapping.
- Keep the integration surfaces distinct in your head. OData exposes records to query, a custom service exposes an operation to invoke, a business event notifies without polling, and the package based API moves bulk on a schedule.
- Security questions are answered by walking the hierarchy: which privilege grants the entry point, which duty contains it, which role contains the duty, and who holds the role. Extensible data security is the separate row level layer on top.
- Remember that a database refresh moves data and a deployable package moves code, and that neither carries the other. A surprising number of environment questions turn on that single fact.
- Microsoft notes that MB-500 may include interactive components, so practise the Yes/No statement blocks, drop down selections, ordering and drag and drop items alongside the multiple choice questions.
Study guide FAQ
What is the MB-500 exam format and passing score?
MB-500 runs for 100 minutes with a passing score of 700 out of 1000. It is proctored, taken at a Pearson VUE test centre or online, and Microsoft notes that it may include interactive components. Microsoft does not publish a fixed question count for this exam, so treat any specific number quoted elsewhere as an estimate. The exam is offered in English and Japanese.
What does the MB-500 skills outline cover, and how is it weighted?
Seven areas, weighted as Microsoft published them on 30 January 2026: Plan the architecture and solution design (5-10%), Apply developer tools (5-10%), Design and develop AOT elements (15-20%), Develop and test code (20-25%), Implement reporting (10-15%), Integrate and manage data solutions (15-20%), and Implement security and optimize performance (10-15%). Developing and testing code is the largest area, with AOT elements and integration close behind, so X++ and the extension model deserve most of your preparation time.
What changed in the January 2026 update to the skills measured?
The 30 January 2026 revision decreased the weighting of Apply developer tools and increased Develop and test code. Application lifecycle management, the data model area and data management each carry a major sub-skill change, with the ALM objectives now covering Unified Developer Experience environments in the Power Platform admin center and the Implementation portal alongside Lifecycle Services. If you are working from older material, make sure those newer ALM topics are covered.
How much X++ do I need to write to pass MB-500?
You will not write code in the exam, but you do need to read it and to know which construct applies. Be comfortable with select statements and their joins, set based operations and when they fall back, transaction scope and exception handling, Chain of Command and event handlers, the SysOperation pattern, and the collection types. Experience writing extensions against a real environment is worth far more than memorising syntax.
Which certification does MB-500 lead to?
Passing MB-500 earns the Microsoft Certified: Dynamics 365: Finance and Operations Apps Developer Associate certification. Like other role based Microsoft certifications it is valid for one year and can be renewed free of charge through an unproctored online assessment on Microsoft Learn during the six months before it expires.
How should I practise for the interactive components?
Treat each statement in a Yes/No block as a separate true or false decision rather than looking for a pattern across the three. For ordering and drag and drop items, think about dependencies: which step cannot happen until another has, and which of the offered actions is a plausible looking shortcut that should never be taken. The CertGrid MB-500 bank includes these formats alongside the multiple choice questions.