Wide uses the full column for everything, text, diagrams, code, and exercises. Narrow keeps the standard reading width.
Text size
Scales the body text. Headings and code blocks keep their size.
In this section
▾
Microsoft 365 Identity Security Engineering: Course Orientation
Module 0
MICROSOFT 365 IDENTITY SECURITY ENGINEERING · MODULE 00
Attackers don't break in. They log in. This course shuts that door.
Identity is the perimeter now, and most tenants defend it with default settings that modern attacks walk straight through. This course teaches you to engineer Entra ID into a perimeter that holds: Conditional Access, Identity Protection, Privileged Identity Management, and token security designed to stop account takeover, MFA fatigue, token theft, and consent phishing at the source. This module shows you what you'll be able to build, the control plane you'll work in, and how the course gets you there.
19 modules
across 4 phases
Deploy-ready
CA policies and detections
40 CPE
credits on completion
No prerequisites
every concept built up
Why this course exists
The network perimeter is gone, and the firewall never sees the attack that matters. The modern intrusion does not breach a boundary, it authenticates: a phished credential, an MFA prompt approved out of fatigue, a stolen session token replayed from another continent, an OAuth consent granted to a malicious app. Every one of those is a successful login, and to most defenses it looks exactly like the legitimate user it impersonates. Identity is where the attack happens, which makes identity the perimeter you actually have to defend.
Defending it is an engineering discipline, not a checkbox. A default Entra tenant leaves the door open: push-notification MFA that AiTM defeats, no Conditional Access, standing admin rights, unrestricted app consent. This course teaches you to close it deliberately, designing and deploying the controls, Conditional Access, Identity Protection, PIM, token and session security, application and workload governance, that map directly onto the attacks they stop. You build the policies and detections against real attack patterns, and you leave able to engineer an identity perimeter that holds.
What you will be able to do
This course is built around the identity perimeter you can engineer at the end, not the features you can name. Every module ties a control to the attack it stops and has you design and deploy it.
Read identity telemetry and harden auth
Work the sign-in logs that show you what is happening, and deploy phishing-resistant authentication as the first line of defense.
Engineer Conditional Access
Design, deploy, validate, and troubleshoot Conditional Access policies that stop real attacks without locking out the business.
Run risk-based defense
Use Identity Protection for user- and sign-in-risk policies with automated remediation, and secure tokens and sessions against replay.
Control privilege with PIM
Replace standing admin rights with just-in-time activation, and shrink the privilege an attacker can reach if they get in.
Secure apps and workload identity
Lock down application registrations, managed and workload identities, and external and B2B access, the identity surface attackers love and defenders forget.
Detect, operate, and architect
Write identity detections, monitor and recover the tenant, integrate with Defender XDR, and design a complete identity security architecture.
You also leave with things you keep: production-ready Conditional Access policies, identity threat detection rules, and a complete identity security architecture design from the capstone, all deployable against a real tenant.
The control plane you will work in
Every access request, from a user, an admin, an application or workload identity, or an external partner, passes through the Entra identity control plane, and that is where you defend. Authentication and MFA, Conditional Access, Identity Protection, and Privileged Identity Management each evaluate the request, and together they decide whether it is allowed access or a blocked threat. Engineered well, that stack turns account takeover, MFA fatigue, and token theft into denied attempts. This course builds and tunes every layer of it.
You build this in Northgate Engineering's Entra tenant, hardening it against the same attack patterns covered through the course, with a free M365 E5 developer tenant giving you a live environment to deploy and test everything in. The discipline is what carries: least privilege, risk-based access, token hygiene, and identity governance are how you secure identity on any provider, so the architecture you learn here ports to Okta, Ping, and any modern identity platform. Entra is the implementation; identity security is the skill.
How the course is built
Nineteen modules move through four phases. You ground the threat landscape and your telemetry, build the Conditional Access and Identity Protection core, extend to application and workload identity, then move into detection, operations, and full architecture, ending with a capstone design.
What you need and who this is for
There are no prerequisites, and every concept is explained the first time it appears. This course is for anyone responsible for the identity perimeter: identity and security engineers building the controls, security architects designing the model, SOC and IR teams who need to understand how identity attacks actually work, and administrators moving from running Entra to securing it.
Transferable identity discipline
Least privilege, risk-based access, token hygiene, and governance secure identity on any platform. Entra is the implementation; the architecture ports to Okta, Ping, and beyond.
A live tenant to build in
A free M365 E5 developer tenant gives you a real Entra environment to deploy and test every policy. Module 0 sets up the lab so you build, not just read.
How to get the most
Deploy each control in your own tenant and try the attack it stops against it. Keep the policies that work, that is how your deployable policy set gets built.
Do I already know this material?
Six quick scenarios across the full range of this course, from identity telemetry to defending against token theft at an architecture level. Answer them to find out where you sit, and whether this course fits or it will sharpen knowledge you already have.
You want to investigate suspicious authentication against Entra ID accounts. What is your primary telemetry?
The Azure billing logs.
The Entra sign-in logs, which record each authentication attempt with the user, application, location, device, conditional-access result, and risk.
Sign-in logs are the heart of identity telemetry: every attempt, with who, what app, from where, on what device, and how conditional access and risk evaluated it. Almost every identity investigation starts there.
The endpoint event logs only.
The mailbox audit log.
You are choosing MFA methods to resist modern phishing. Which is the strongest choice?
Phishing-resistant methods such as FIDO2 security keys or passkeys, which are bound to the legitimate site and cannot be relayed by an adversary-in-the-middle proxy.
Adversary-in-the-middle phishing relays codes and prompts in real time, defeating SMS, email, and push approval. FIDO2 and passkeys are cryptographically bound to the real site, so a proxy has nothing to relay.
SMS one-time codes.
Email one-time codes.
Security questions.
Attackers keep authenticating with legacy protocols that bypass your MFA policies. What Conditional Access design most directly addresses this?
Lower the MFA requirement so users stop complaining.
Disable Conditional Access entirely.
Block legacy authentication protocols, which cannot enforce modern controls like MFA and are a common bypass, then require MFA on the modern flows.
Legacy protocols predate modern controls and cannot present an MFA challenge, so they are the standard way attackers sidestep it. Blocking them closes the bypass; requiring MFA on the modern flows covers the rest.
Require MFA only for administrators.
Your administrators all hold standing global-admin rights. What is the better privileged-access model?
Keep standing rights; it is simpler.
Just-in-time elevation through Privileged Identity Management: admins activate the role only when needed, with approval and time limits, so the standing attack surface is minimised.
Standing global admin is a permanent high-value target. Just-in-time elevation means the privilege exists only briefly, on request, with approval and expiry, so a compromised account is rarely sitting on live admin rights.
Share one admin account among the team.
Give every admin a second standing account.
A third-party application's service principal has been granted broad, tenant-wide application permissions. Why is this a significant risk?
It is not; applications are inherently trusted.
It only affects that one application's own data.
Service principals cannot be misused.
A service principal with broad application permissions acts without a user or MFA and persists independently of any user's credentials, so if it is compromised or malicious it holds wide, password-independent access.
App permissions run as the application itself, with no user and no MFA, and they outlive any password reset. A broad grant to a compromised or rogue app is therefore durable, unattended access across the tenant.
Even with strong MFA, attackers steal session tokens and replay them. At an architecture level, what most reduces this risk?
Nothing; token theft is unstoppable.
Longer passwords.
Layered controls that re-evaluate sessions, such as continuous access evaluation and policies that bind sessions to device compliance and revoke on risk, so a stolen token does not grant durable access.
MFA protects authentication, not the session after it. Continuous re-evaluation, device-bound sessions, and revocation on risk mean a stolen token is checked again and cut off, rather than serving as a lasting key.
Disabling MFA to simplify sessions.
This course is for you.
You will build Entra ID security from sign-in telemetry and authentication through Conditional Access, Identity Protection, privileged access, token security, and full identity security architecture.
You have the fundamentals. The value here is the harder half.
You know the telemetry and core controls, so the payoff is the back half: token and session security, application and workload identity, external identities, identity governance, detection engineering, and the architecture capstone.
You handled telemetry, phishing-resistant auth, legacy-auth bypass, just-in-time admin, workload identity risk, and token-theft architecture, the senior end of the discipline. Take the course to sharpen what you have, close the gaps you did not expect, and turn strong instincts into a complete identity security design.
You are a student of this course now, so start by deciding what you want from it. Are you here to shut down a specific class of identity attack, to engineer a tenant from defaults to defensible, or to design an identity security architecture you can stand behind? Name that outcome, then turn it into a study plan: which controls and phases matter most to your environment, how much time you will give it each week, and what you want to have engineered by the time you finish.
The rest of Module 0 sets you up to do exactly that. Work through it to see why identity is the new perimeter, how authentication actually works, the Entra security stack, the attack patterns and the identity kill chain, the zero-trust model, real-world breaches, the defense design method, and how to measure your posture. Then begin Module 1.
Stuck on this lesson?
Your question goes straight to the team and we'll reply by email. Sign in to ask.
