Entra ID Detection and Operations

What Entra ID Detection and Operations teaches: detect the identity attacks that get past Conditional Access, govern the workload and external identities no control reaches, and run the estate that produces the signal. The tables you will query, the detections you will write, and how the course is structured. Start here.

Most identities in a tenant are not people. What they are, what they can reach, why the interactive controls do not apply to them, and the four activities that decide whether any of it is governed.

A cross-tenant access configuration you can defend, inbound and outbound. The population you inherited, the settings nobody chose, and the one property that inherits from the default when somebody leaves it unset.

A permission arrives by one of four paths and only some of them record why. What governance produces that a detection can join against, and what each control can actually end.

Detection engineering is a development discipline. One detection carried through ten stages, from a line of threat intelligence to a merged pull request, and two more you build yourself.

Detections decay, configurations drift, and log sources stop without failing. What you watch day to day, and how you find out before an investigation does.

The platform now backs your tenant up and keeps seven days of it. Median dwell time is fourteen. This module is about the gap, and about the restore that succeeds and leaves the attacker in place.

An identity-only view sees one segment of an attack. This module is about what the other products see, what disabling a compromised account actually depends on, and the seam between the cloud directory and the one on your domain controllers.

The seam the rest of the course depends on. Which Entra categories you export, which table each one lands in, what it costs, how long it stays queryable, and which tier decisions silently switch a detection off.

One attack that Conditional Access did not stop, worked from the alert to the routing decision to the detection to the response, in a tenant that cannot currently see half of it.

Subject-area sheets for identity work: where the control lives in the portal, the query that answers the question at scale, and what the answer does not prove.

Seven runbooks for the procedures an identity engineer repeats: deploying a policy, retiring a method, migrating to PIM, onboarding a partner, and getting a tenant back.

A complete build for an identity lab: tenant, workspace, telemetry, a population, a partner tenant, and the checks that prove it works.

Worked identity investigations end to end, including the wrong turns, the queries that looked right and were not, and what would have changed each answer.

Seven configuration and governance events that fire at an identity engineer, each with the clearing check, what escalates it, and how to reverse it.

Where to practice the identity work in this course against real data, without a tenant of your own.

External sources this course draws on: Microsoft Entra documentation, detection guidance, frameworks and community research.

You've reached the end of Identity Detection and Operations. This closing module looks back at what you built across the course, how it changed the order you work in, and where to take it next.