Microsoft Security Operations

What Microsoft Security Operations teaches: operate the full Microsoft security stack, Defender XDR, Sentinel, Purview, Defender for Cloud, and Security Copilot, as one SOC, running the detect, investigate, respond, and recover lifecycle and finishing on real investigation scenarios. The operation you'll run, the playbook and detections you walk away with, and how the course is structured. Start here.

Operate the unified Microsoft Defender XDR platform as an integrated investigation and response tool. Incident triage, cross-product correlation, remediation actions across email, endpoint, identity, and cloud apps. Daily SOC workflow. Advanced Hunting queries that trace multi-stage attacks across the full kill chain.

Deploy, configure, and operate Microsoft Defender for Endpoint as a preventive and investigative platform. Architecture and licensing decisions. Device onboarding across Windows, macOS, Linux, and down-level servers. Attack surface reduction rules. Next-generation protection and EDR configuration. Device investigation with timelines and live response. Automated investigation with progressive automation levels.

Investigate DLP alerts, insider risk incidents, audit log anomalies, and eDiscovery content searches. Master the data protection and compliance investigation capabilities that the SC-200 exam tests and that SOC analysts use when threat investigations extend beyond endpoint and identity into data access, exfiltration, and policy violations.

Plan, deploy, and operationally manage Microsoft Defender for Cloud across Azure, hybrid, and multi-cloud environments. Configure cloud security posture management, enable workload protections for servers, storage, SQL, containers, and app services, investigate and remediate security alerts, and integrate Defender for Cloud with Sentinel for cross-product cloud security operations.

Use Microsoft Security Copilot to accelerate incident investigation, generate KQL queries, summarize complex alerts, perform guided threat hunting, and automate routine SOC analysis. Master the standalone experience, embedded experiences across Defender XDR, Sentinel, Entra ID, and Purview, and the prompting techniques that produce investigation-quality output.

Learn to write KQL from scratch, from your first query to complex multi-table investigation joins. This module builds the skill that every subsequent module depends on.

Design, deploy, and operationally manage a Microsoft Sentinel workspace from scratch. Master workspace architecture decisions, log tier assignments, data retention policies, cost management, the key security tables and their schema, watchlists, threat intelligence integration, Defender XDR unification, Content Hub solutions, workspace health monitoring, RBAC, and multi-workspace governance.

Connect every data source in your environment to Sentinel, Microsoft first-party services, Defender XDR, Windows hosts, third-party devices via Syslog and CEF, and custom applications via API ingestion. Build Data Collection Rules to filter, transform, and route data before it reaches the workspace. Troubleshoot connector failures, validate data flow, and optimize ingestion cost at the source.

Configure anti-phishing, Safe Links, Safe Attachments, ZAP, email authentication, transport rules, and Threat Explorer, the complete email protection stack for a Microsoft 365 environment.

Build the detection and investigation layer that turns raw data into actionable security incidents. Create scheduled analytics rules, near-real-time rules, and Microsoft Security rules. Configure entity mapping for alert correlation. Manage incidents through the investigation lifecycle. Automate response with automation rules and Logic Apps playbooks. Deploy UEBA for behavioral anomaly detection. Build workbooks for security reporting. Normalize data with ASIM parsers.

Move from reactive detection to proactive threat discovery. Learn hypothesis-driven hunting methodology, write hunting queries that find threats analytics rules miss, use bookmarks to collect and preserve evidence, deploy Livestream for real-time hunting, run search jobs against archived data, and build a structured hunting program with MITRE ATT&CK coverage tracking.

Full incident response on a real five-wave AiTM phishing campaign. You will investigate from first alert through containment, eradication, scope assessment, CISO reporting, hardening, and detection engineering. Every KQL query, containment action, and investigation decision is drawn from a production incident. You leave with: a complete AiTM investigation playbook, 8 deployable detection rules, an IR report template, and a hardening checklist.

Full investigation of a business email compromise leading to a vendor payment diversion attempt. You will trace the attack from initial mailbox compromise through thread hijacking, invoice manipulation, and fraudulent payment request, then contain, eradicate, and report. You leave with: a BEC investigation playbook, 6 deployable detection rules, a financial fraud response checklist, and an IR report template adapted for BEC.

Deep investigation of post-authentication token abuse, the persistence technique that survives password resets and MFA re-registration. You will trace stolen tokens through interactive and non-interactive sign-in logs, identify token replay vs legitimate multi-device usage, assess Continuous Access Evaluation effectiveness, and deploy token-binding conditional access policies.

Investigate malicious OAuth application consent, the attack that grants an attacker persistent API access to mailboxes, files, and directory data without stealing any credential. You will trace the consent grant, assess the application's permissions, determine what data was accessed, revoke the grant, and deploy preventive controls.

Investigate data exfiltration by an authorized user, the investigation type that involves HR, legal, and evidence standards that external-attacker incidents do not. You will trace file downloads, email forwarding, cloud storage uploads, and USB transfers using M365 and endpoint telemetry. You leave with: an insider threat investigation playbook, 5 deployable detection rules, an evidence preservation checklist, and an HR/legal coordination guide.

The KQL, the workspace, the connectors and the investigation pivots, one sheet per part of the stack.

Ordered procedures for the work an M365 security operations analyst does: shift start, triage, investigation, containment, deployment and reporting.

A trial tenant with real telemetry, the connectors that matter, and every silent failure produced on purpose.

Six investigations reasoned end to end, including the ones where the answer was that the evidence did not exist.

What to do when an identity alert fires, a phishing campaign lands, a rule goes quiet, or somebody asks what was exposed.

Four Incident Lab scenarios, a three-part exam, a lab pack and your own tenant, with what each one is good for.

The commands, queries and configuration references from this course in one place, organized for lookup during live work.

External sources this course draws on: Microsoft documentation, frameworks, standards and community research.

Microsoft Security Operations end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.