M365 Incident Response Course: Scope, Structure and Boundaries

Introduction

This course teaches you to respond to a security incident in a Microsoft 365 tenant, from the first indication that something is wrong to a report somebody outside the team can rely on.

This section covers what that means in practice, what the course does not attempt, and where it sits against the other things you could spend the time on. It is the section to read before deciding whether the rest is worth your week.

The split below is the one fact this whole course rests on, and it is worth reading slowly.

Every course makes a claim about what it will teach. This one is easier to describe by what it can physically reach, because the reach is unusually narrow and everything else follows from it.

The single fact that shapes everything here is what a Microsoft 365 investigation can physically reach.

In software as a service the provider manages everything except your data and your user access. Your investigative scope is audit logs, user activity and the data itself. You cannot request a memory dump of the server running Exchange Online, and you cannot image the storage underneath SharePoint.

The word that does the work is underneath. You hold the data and the records of what happened to it, and everything the data sits on belongs to somebody who will not give you access to it under any circumstances, including a court order directed at you.

You will engage Microsoft support during some incidents and they will help with a service problem. They will not investigate your case, scope your compromise or tell you which mailboxes were read. That work is yours, and it is done from records rather than from systems.

That is a harder boundary than it sounds, and it is worth comparing across the service models to see why this course exists as a separate subject.

The three service models divide the estate differently, and the row you are in decides what an investigation can even attempt.

Read the three rows as a progression rather than a comparison. Each step upward hands more of the estate to the provider, and each step removes a class of evidence from you, until at the top you hold the data and the access records and nothing else.

There is one consolation in the trade and it is worth knowing early. The records you do get are centralized, queryable and cover the whole estate at once, where a host investigation reaches one machine at a time. What you lose in depth you gain in reach, and several techniques in this course have no equivalent in host forensics for that reason.

Everything a traditional responder relies on for ground truth is unavailable here. No memory, no disk, no process list, no packet capture. What replaces them is a set of records produced by somebody else's platform on somebody else's schedule, and learning to work from those records is the whole of the discipline.

It also inverts which skills transfer. A responder who is expert at reading a disk image starts here with most of that expertise inapplicable, while somebody who has spent years reading logs starts closer than their job title suggests.

Connect-ExchangeOnline

Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) `
                       -EndDate   (Get-Date) `
                       -ResultSize 10 |
  Select-Object CreationDate, UserIds, Operations, RecordType

That is not a lesser form of investigation. It is a different one, and it has its own techniques, its own limits and its own way of being wrong.

Section one is about the platform. This one is about the plan most organizations already have, and why having a good one does not help.

The scenario above is not a strawman, and the failure it describes is documented by the vendor rather than by us.

It is worth using the vendor's own words here rather than ours, because an argument that your plan has gaps lands differently when the platform's own guidance says so.

Microsoft's own cloud security benchmark names it directly: traditional plans miss the cloud shared responsibility model, the investigation tools and cloud forensics, causing incomplete response and evidence loss. Those are three separate gaps in one sentence, and an organization can have an excellent plan and all three.

Read those three gaps against a plan you know. Shared responsibility decides whose job the evidence is; investigation tools decide whether you can reach it; cloud forensics decides whether you know what it means. A plan can cover incident management thoroughly and address none of them.

The same source names a second failure worth quoting because this course is built against it: organizations discover gaps in tools, skills and procedures during actual incidents rather than in controlled testing.

Evidence loss is the phrase to sit with. It is not that the response is slower; it is that material which existed at the start of an incident is gone by the point somebody knows to ask for it, and per the first module that happens on a schedule nobody in the organization set.

That second failure is the one this course is shaped around. Every module ends by asking you to check something in your own environment, and the reason is that the checks are cheap on an ordinary afternoon and impossible during an incident.

That is the argument for practice cards rather than reading, and it is why this course asks you to run things against your own tenant in almost every section.

The gap is not competence and it is not effort. It is that a plan written for an estate you own does not describe an estate you rent, and the differences only surface at the moment the plan is being used.

The list below is the answer to what am I committing to, and what each module produces is the more useful half of it.

The course is an orientation module, ten teaching modules and a capstone, and each teaching module is built to produce a specific capability rather than to cover a topic.

Each module is built to produce a capability rather than to cover a topic. This is what each one leaves you with.

Read the entries in order and the arc is visible. The first two modules are about the tenant before anything happens, the middle five are an incident in the order it unfolds, and the last three are what you do with the result. Nothing in the list is a topic survey.

Two of the ten are worth flagging now because they are where this course differs most from a generic incident response syllabus.

Evidence collection is a module of its own, separate from forensics, and the split is deliberate. Module 4 is about what you take and whether it will hold; module 5 is about what it says. Conflating them is how evidence gets collected in a way that answers the wrong question, and it is a distinction that barely exists in host forensics where the acquisition is an image.

The capstone in module ten is the same case work under time pressure rather than new material, and the course exam tests the same thing again, so the last stretch is deliberately about doing rather than learning.

Module one is the exception to the pattern in that it produces a position rather than a capability, and it is deliberately first. Almost everything that decides whether an M365 investigation succeeds was settled before it started, and knowing what was settled is the difference between an investigation and an improvisation.

The course is navigable rather than linear. Later modules build on earlier ones rather than repeating them, so the earlier ones are worth doing first, and a reader who arrived for a specific subject should go to that module.

The structure is the same in every section of every module, which is deliberate: once you know the shape you can find the part you need without reading the whole thing.

Every teaching section in this course does three things in the same order, and knowing the shape makes it easier to use.

None of the three is optional and the third is the one people skip.

It teaches the subject in prose, with the reasoning rather than the conclusion, because a rule you cannot derive is a rule you cannot adapt when the situation differs.

It demonstrates the action, with the portal path and the command, against the fictional Northgate Engineering tenant that runs through the whole course.

Northgate is not a sanitized environment. It has mixed licensing, a partial export configuration, an on-call rota with the wrong permissions and a plan nobody has read since it was approved, because those are the conditions a real response happens in.

Then it hands the action to you. Every section closes by asking you to carry it out in your own environment, and the closing card says what you should end up with.

Every section is built the same way and the order is not arbitrary.

The order matters. Teaching before demonstrating means you understand why the command is the right one; demonstrating before doing means you know what a correct result looks like before you generate one of your own.

Northgate Engineering is worth introducing here because it appears everywhere. It is a fictional 810-person engineering company running Microsoft 365 with a small security team, chosen because it is the size where the problems in this course actually bite: large enough to have real data and real regulatory exposure, small enough that one person is frequently the whole response.

That structure is why the course is longer to work through than to read. The practice cards are the part that produces the findings, and skipping them leaves you knowing the material and not knowing your environment.

A course that claims to cover everything covers nothing at a useful depth, so the boundaries below are drawn deliberately rather than by omission.

Being specific about the exclusions is more useful than a broad claim, and each one has somewhere better to go.

Each exclusion below is a real subject rather than a gap, and in most cases this catalog covers it elsewhere.

Windows endpoint forensics beyond what an M365 investigation reaches. A case that starts in a tenant frequently ends on a laptop, and the laptop is a different discipline with its own tooling.

Where a case crosses that line the course says so and hands you the question to take with you, which is more useful than a shallow treatment of a subject that needs its own week.

Memory analysis and malware reverse engineering. Neither is reachable from a tenant, per section one, and both are substantial subjects in their own right.

Detection engineering as a discipline. This course writes detections where a response needs one; building and maintaining a detection program is a different job.

Offensive technique execution. Attacks appear here as evidence and as recognition. You will learn to identify a device code phishing attack from what it leaves behind, and not to run one.

The offensive exclusion is worth expanding because it affects how the attack material reads. You will see what an attack leaves in the logs, what the artifacts look like and how to recognize one in progress. You will not see the tooling, the commands or anything that would help somebody run it, and that boundary holds across the whole course.

And no career advice. It is not a teaching subject and it does not belong in a technical course.

The shared responsibility split is worth taking further than a diagram, because it decides what the rest of this course can teach. What the provider manages, you cannot examine directly, and what you configure is the only thing an investigation reaches. Per IR2.1 that is why preparation comes so early here: the evidence an incident needs either exists because somebody configured it to, or it does not exist at all and no amount of skill during the response recovers it.

Nothing in section five is a criticism of the courses that cover those subjects, and this section is about choosing between the ones that overlap with this one.

There are other ways to spend this time and it is worth being honest about them.

Two categories overlap enough to be worth comparing directly.

The major cloud forensics courses cover several providers. They teach Azure, AWS and Google Cloud together, which is the right shape for a consultancy responder who meets all three and a broader one than most in-house teams need. This course covers one tenant, in depth, including the parts that only matter when it is the estate you actually run.

The advanced enterprise IR courses assume prior knowledge and say so, skipping introductory host and network forensics. This course is self-contained: every concept is explained at first use and there is no minimum experience.

Self-contained is a deliberate choice rather than a marketing claim. It means the course is slower in places for an experienced reader and reachable for somebody who has never run an investigation, and the audience section says who each of those is.

Within this catalog the boundaries are cleaner. Windows endpoint work is the endpoint investigation course, memory analysis is the memory forensics course, and building identity detections is the identity detection course. Where this course touches those subjects it cites them rather than re-teaching them.

Depth against breadth is the real decision. A responder who meets three cloud providers a year needs to recognize all three; a responder who lives in one tenant needs to know its retention behavior, its permission model and the specific ways its records mislead, none of which survives being covered in a third of a course.

The certification landscape is worth knowing about and is not what this is. Cloud forensics certifications exist and test across providers; this course teaches a job rather than a syllabus, and its own exam tests the same case work the modules do.

One more consequence follows and it is the reason this course exists in the shape it does. In a tenant there is no disk to image, no memory to capture and no agent to interrogate, so the whole discipline reduces to reading records that a service wrote for its own purposes. Per IR4.1 that is a narrower and stranger job than endpoint forensics, and the techniques transfer badly in both directions.

Sections one to six describe the course. This one is about whether it is aimed at you, and the honest answer includes the cases where it is not.

The course is written for anybody who has to answer for a Microsoft 365 tenant when something goes wrong.

That includes the SOC analyst who receives the alert, the administrator who is the only security person in the organization, the consultant who arrives after the fact, and the IT lead who has never run an incident and will have to.

The common thread is responsibility rather than job title. If somebody would come to you when a mailbox is compromised, this course is written for you regardless of what your role is called or how long you have been doing it.

No minimum experience is assumed. Every concept is explained the first time it appears, and the environment is described rather than presumed.

It is also written for somebody who has done this before in a different estate. A responder with years of host experience is not starting from zero here; they are starting with a set of instincts that mostly do not apply, which is a different problem and one the first module addresses directly.

Two groups will find parts of it slow. A practitioner who already runs M365 investigations daily will know module one and should skim to where the material is new. And somebody looking for endpoint forensics will find this the wrong course, for the reasons in section five.

Neither group should feel misplaced. A practitioner skimming module one and working modules four and five carefully has used the course correctly, and somebody discovering in section five that they wanted endpoint forensics has saved themselves a week.

The material assumes you have or can reach a tenant. Per the lab setup module you do not need a production one, and running the practice cards against something real is what separates finishing the course from having done it.

That absence is the shared responsibility model as a working constraint rather than a diagram.

The exercise below takes twenty minutes and produces the two things worth having before module one: a specific question, and evidence that your existing plan does not answer it.

Both answers are useful before module one. A question gives the material something to attach to, and a plan with a visible gap gives the practice cards a reason to be run rather than read.

The next section is how to work through the material, including what to do with the practice cards and what to do if you have arrived for one specific module.