Microsoft Cloud Incident Response

Course overview

Microsoft Cloud Incident Response teaches the complete incident response lifecycle for Microsoft 365 environments. Every module produces a capability you can execute during a real incident. You configure the environment that preserves evidence before you need it. You build the playbooks and runbooks that eliminate improvisation under pressure. You run investigations using KQL, Graph API, and PowerShell against the same log sources and evidence tables you'll query during a real compromise. You execute containment through Conditional Access, session revocation, and OAuth grant removal. You hunt for what the detections missed and convert a finding into a rule that runs without you. You handle the notification, the legal coordination and the post-incident improvement. And you recover the tenant, which is the phase most courses name and skip: what Microsoft 365 can restore, what it cannot, and why a completed recovery is a partial resolution of most modern incidents.

The course follows the incident response lifecycle across five phases: orientation and foundations, detection and investigation and containment, responding by attack type, hunting and the aftermath, and recovery. Guided walkthroughs in every module put you through end-to-end scenarios. Incident Lab scenarios let you practice investigation queries against synthetic data with known answers.

How this course works

Every module in this course runs the same six-step loop against a Microsoft 365 tenant. It is the habit the course is built to install, because it is the sequence that produces a claim somebody else can check rather than an account somebody has to take on trust.

1. Establish what the tenant recorded. Before any query, know which operations are collected at your license tier, how long they are kept, and what was never written down. An empty result means one of three things and only one of them is about the incident.

2. Scope from the record rather than from the alert. The alert is where the case reached you. The scope comes from reading the audit trail, both sign-in tables and the file and mail activity, and it is almost always larger than the alert suggested.

3. Preserve before you collect. Preservation stops a clock; collection takes a copy. Doing the second without the first means the material can expire between the decision and the export.

4. Contain across the four paths. Sessions, credentials, application identities and sharing links fail independently. Closing three properly still leaves the fourth open, and it is usually the one nobody looked at.

5. Verify that the action landed. Taking an action and proving it worked are separate pieces of work. Every check needs a positive control, because an empty result is a claim about your query as much as about the tenant.

6. State what the evidence supports, and what it does not. A figure without its basis is a figure somebody else will derive differently. A gap in the record is a finding with an owner rather than an apology.

Recovery closes the loop and does not undo it. What can be restored, in what order, and why the copy that already left is unaffected by any of it.

What this course assumes

No minimum experience and no prerequisite course. Every concept is explained where it is first used, including the ones a syllabus like this would normally assume: what the unified audit log is, why there are two sign-in tables, what a refresh token does. If you have never opened the Defender portal, start at module zero and nothing will be missing.

What does make it go faster: a Microsoft 365 tenant you can read, even a developer one, and enough comfort with a command line to run a PowerShell cmdlet and read what comes back. Neither is required. Every query in the course can be practiced against the Practice Hub instead, which holds populated tables and known answers, and the lab module walks through building a tenant from nothing if you want one.

What the course does not cover, deliberately: endpoint forensics beyond what Microsoft 365 reaches, memory analysis, and malware reverse engineering. Those are separate disciplines with their own courses, and a cloud investigation that pretends to teach them alongside teaches neither properly.

Who this course is for

Anyone who wants to learn cloud incident response. The course is built for security analysts, SOC engineers, IT administrators responsible for M365 security, and anyone who needs to investigate or respond to incidents in Microsoft 365 and Entra ID environments. No minimum experience required. Every concept is explained at first use, and experienced cybersecurity professionals can skip ahead using the module structure.

What you'll learn

Key course takeaways