Microsoft Security Training

Lesson 1 • Licensing and Deployment Models

Explains Microsoft security licensing tiers and deployment options. Enables informed decisions about feature availability and rollout strategy.

Lesson 2 • Microsoft Security Portfolio Overview

Introduces the full range of Microsoft security products and how they interrelate. Provides the mental model needed for all subsequent chapters.

Lesson 3 • Microsoft Security Architecture Pillars

Covers identity, endpoints, data, apps, infrastructure, and network as security pillars. Connects each pillar to specific Microsoft tooling.

Lesson 4 • Threat Landscape and Attack Vectors

Surveys modern adversary tactics, techniques, and procedures relevant to Microsoft environments. Grounds product selection in real threat scenarios.

Lesson 1 • Identity Protection and Risk Policies

Configures user risk and sign-in risk policies using machine-learning signals. Automates remediation for compromised identities.

Lesson 2 • Entra ID Core Concepts

Covers tenants, directories, users, groups, and service principals. Establishes the identity objects that all access policies depend on.

Lesson 3 • Conditional Access Configuration

Explains policy conditions, grant controls, and session controls for adaptive access. Implements context-aware enforcement across all sign-ins.

Lesson 4 • Privileged Identity Management

Covers just-in-time privileged access, approval workflows, and access reviews. Minimizes standing privilege exposure in the tenant.

Lesson 1 • Vulnerability Management

Uses Defender Vulnerability Management to prioritize and remediate software weaknesses. Connects exposure data to remediation workflows.

Lesson 2 • Defender for Endpoint Architecture

Explains sensor deployment, data flow, and portal components. Provides the operational foundation for all endpoint security tasks.

Lesson 3 • Defender for Business and SMB Scenarios

Addresses simplified Defender configurations for smaller organizations. Ensures security coverage scales across enterprise and SMB environments.

Lesson 4 • Attack Surface Reduction Rules

Configures ASR rules to block common malware behaviors before execution. Directly limits the techniques attackers use against endpoints.

Lesson 1 • Security Alerts and Threat Detection

Analyzes Defender for Cloud alerts, suppression rules, and alert correlation. Enables accurate triage of cloud-native attack signals.

Lesson 2 • Defender for Cloud Fundamentals

Introduces Secure Score, recommendations, and workload protection plans. Establishes the posture management baseline for cloud environments.

Lesson 3 • Cloud Security Posture Management

Covers regulatory compliance dashboards, governance rules, and attack path analysis. Translates posture findings into prioritized remediation actions.

Lesson 4 • DevSecOps and Supply Chain Security

Integrates Defender for Cloud into CI/CD pipelines and scans infrastructure-as-code. Shifts security left into the development lifecycle.

Lesson 1 • Sensitivity Labels and Encryption

Creates and publishes sensitivity labels with encryption, marking, and access controls. Labels enforce protection wherever labeled content travels.

Lesson 2 • Microsoft Purview Data Governance

Covers data catalog, data map, and data estate insights for governance. Connects data discovery to protection and compliance workflows.

Lesson 3 • Sensitive Information Types and Classifiers

Builds custom and built-in sensitive information types and trainable classifiers. Accurate classification underpins all downstream protection policies.

Lesson 4 • Insider Risk Management

Configures insider risk policies to detect data theft, leakage, and sabotage signals. Balances user privacy with organizational data protection.

Lesson 1 • SOAR Automation with Playbooks

Builds Logic Apps-based playbooks for automated incident response actions. Reduces mean time to respond by automating repetitive SOC tasks.

Lesson 2 • Sentinel Architecture and Data Ingestion

Covers workspace design, data connectors, and log ingestion cost management. Proper architecture ensures complete visibility without excessive cost.

Lesson 3 • Analytics Rules and Threat Detection

Creates scheduled, near-real-time, and ML-based analytics rules. Translates threat intelligence into automated alert generation.

Lesson 4 • Incident Investigation and Hunting

Uses the investigation graph, bookmarks, and hunting queries to analyze incidents. Builds structured investigation habits for SOC analysts.

Lesson 1 • Compliance Manager and Assessments

Configures Compliance Manager assessments and tracks improvement actions. Provides a quantified compliance posture score for stakeholder reporting.

Lesson 2 • Audit Logging and Investigations

Configures unified audit log search and advanced audit capabilities. Provides forensic evidence for compliance investigations and breach response.

Lesson 3 • eDiscovery and Legal Hold

Manages Content Search, eDiscovery Standard, and Premium cases for legal requests. Preserves and exports data in a defensible, auditable manner.

Lesson 4 • Retention Policies and Labels

Creates retention policies and labels to meet records management obligations. Ensures data is kept or deleted according to defined schedules.

Lesson 1 • Incident Response Frameworks and Playbooks

Applies structured IR frameworks to Microsoft environment incidents. Standardizes response actions to reduce decision fatigue under pressure.

Lesson 2 • Proactive Threat Hunting Methodology

Establishes hypothesis-driven hunting using threat intelligence and behavioral analytics. Moves security posture from reactive to proactive detection.

Lesson 3 • Advanced Hunting in Microsoft 365 Defender

Uses the unified advanced hunting schema across identity, endpoint, email, and cloud. Enables cross-domain correlation of attacker activity.

Lesson 4 • Responding to Identity and Cloud Attacks

Covers response procedures for compromised accounts, token theft, and cloud resource abuse. Addresses the most prevalent attack patterns in Microsoft environments.