Sign In
Free Course

For IT administrators and helpdesk professionals managing M365 tenants

Aligned to NIST SP 800-63CIS ControlsISO 27001NCSC guidance

M365 Security: From Admin to Defender

Go from managing M365 to securing it — without starting from scratch.

Configure the security controls that protect your Microsoft 365 tenant against the attacks that target it every day. Set up multi-factor authentication and Conditional Access properly, deploy email protection that catches phishing, understand security alerts and what to do when they fire, and present your security posture to management in terms they can act on.

Start Free — No Account Needed
Content last updated: May 2026

Text-based · Persistent labs on your own hardware · Entirely free — no account needed · Content last updated: May 2026

What you'll deploy
✓ Security mindset and threat model for your M365 environment
✓ Understanding of the M365 security stack: Defender, Sentinel, Entra ID
✓ Baseline security configuration assessment for your tenant
✓ Foundation knowledge for the Security Engineer learning path
✓ Transition roadmap from IT administration to security operations
✓ Familiarity with KQL, detection concepts, and investigation basics
WHERE YOU ARE M365 Admin Center Exchange Online Entra ID basics Intune / Autopilot Teams / SharePoint THIS COURSE WHERE YOU'LL BE Defender portal Conditional access Email protection Incident response Security reporting

Overview

There are hundreds of introductory cybersecurity courses available. Most of them spend weeks teaching you about firewalls, network segmentation, and the OSI model. If your job is to secure a Microsoft 365 tenant, almost none of that is immediately useful.

M365 Security: From Admin to Defender starts where you are: managing an M365 environment. You already know how to create users, assign licenses, configure Exchange Online, and deploy applications through Intune. What you have not had the chance to learn is how to secure that environment against the phishing attacks, compromised accounts, and data leaks that target it every day.

Across multiple modules, you will learn to configure multi-factor authentication and conditional access properly (including handling the exceptions that every organization has), set up email protection that actually catches phishing, understand what security alerts mean and what to do when they fire, and present your security posture to management in terms they can act on.

Everything is specific to the Microsoft 365 environment. No theoretical detours. No padding. Just the security knowledge you need for the tenant you already manage.

Audience profile

IT administrators who have been given security responsibilities. You are the person who has been managing an M365 tenant for a year or two, and now your manager has asked you to "also handle security." You do not need to learn what a firewall is. You need to learn how to configure conditional access without locking out your CEO, and what to do when someone in finance clicks a phishing link.

Helpdesk team leads stepping up. You have been resetting passwords and managing devices, and you want to move into a role with more responsibility. Understanding M365 security is the most direct path from helpdesk to security operations for anyone already working in a Microsoft environment.

MSP technicians responsible for client security. You manage five or ten M365 tenants and you need a repeatable security baseline you can deploy across all of them. This course gives you the knowledge and the configurations to do that efficiently.

Prerequisites: Experience managing a Microsoft 365 tenant — creating users, managing Exchange Online, basic Entra ID familiarity. No security certifications or prior security experience required.

Anyone with a genuine interest in M365 security. Whether you are an IT administrator who has just been handed security responsibilities, a helpdesk professional looking to move into security, or someone exploring a career change into cybersecurity through a platform you already know — if you are willing to put in the work, this course is for you. Backgrounds vary. Motivation is what matters.

Course syllabus

8 modules across 3 phases — all completely free, no account required. Structured around the security tasks that matter most for an M365 environment in the order you should tackle them. Identity first, then email, then devices, then monitoring and response.

Free Phase 1 — Foundations

AD0
The M365 Security Landscape — What attackers actually target in M365 (identity, email, data), the security tools already in your E3/E5 license and which ones are turned on by default (almost none), security defaults vs conditional access, navigating the five admin portals (Entra, Defender, Intune, Purview, M365 Admin), reading your first security alert without panicking, Secure Score as a prioritization tool, the NE baseline assessment, and the 10-week security improvement sequence.
 AD1
Securing Identities in Entra ID — Why identity is the perimeter (99.9% of credential attacks stopped by MFA), what MFA protects against and what it doesn't (AiTM, token theft, MFA fatigue), deploying MFA without breaking production (5-step sequence), building your first three conditional access policies step by step (CA001 MFA, CA002 legacy auth block, CA003 device compliance), handling exceptions (executives, shared accounts, service accounts, FIDO2 keys), self-service password reset with writeback, Entra ID Protection risk detections, sign-in log investigation (5 fields to check first), the 15-minute compromised account response procedure, and reporting identity security to management.

Free Phase 2 — Protection

AD2
Protecting Email with Defender for Office 365 — Anti-phishing policies beyond defaults, Safe Links (URL rewriting and click-time scanning), Safe Attachments (sandbox detonation), configuring SPF/DKIM/DMARC step by step, anti-spam tuning, user-reported phishing workflow, investigating a reported phishing email with message trace, and email protection monitoring.
 AD3
Managing Devices and Endpoints — Intune device enrollment for corporate and BYOD, building compliance policies (BitLocker, OS version, firewall, AV), integrating compliance with conditional access, security baselines vs custom policies, Windows Autopilot security configuration, handling non-compliant devices, and the exception workflow.
 AD4
Data Protection Fundamentals — Sensitivity labels (Confidential, Internal, Public), auto-labeling policies, basic DLP rules for email and Teams, information barriers, SharePoint external sharing controls, and preventing accidental data exposure without blocking legitimate work.
 AD5
Security Monitoring and Alert Triage — The 15-minute Monday security review, navigating the Defender portal incident queue, understanding alert severity and classification, reading the attack story (entities, evidence, timeline), classifying incidents (true positive, false positive, benign true positive), configuring alert notifications, Secure Score as a weekly health check, and building the monitoring cadence that catches issues before they become breaches.

Free Phase 3 — Operations

AD6
Basic Incident Response — The compromised account response procedure in depth (revoke, reset, review, remove, report), phishing response workflow (user clicked a link — now what?), business email compromise response, coordinating with a managed SOC or external IR provider, evidence preservation basics, the after-hours decision (wake the team or wait until morning?), documenting what happened, and automatic attack disruption.
 AD7
Security Governance and Program Documentation — The security policies your organization needs (acceptable use, password policy, incident response plan, data classification), writing policies that people actually read, building the complete quarterly security posture report, the security program summary document, audit readiness for ISO 27001, NIST CSF, and regional security frameworks, making the case for security budget and E5 upgrade, and bridging to the Ridgeline documentation products for comprehensive policy sets.

Expected outcomes

What this produces

MFA, Conditional Access, email protection, security alerts, and posture reporting — configured and documented. The security foundation for your M365 tenant, built from "I manage M365 tenants" to "I own M365 security" — the bridge course that turns IT skills into a credible entry point for security operations and SC-200 track work.

What you will be able to do

1

Configure identity protection that prevents most account compromises

Conditional access and MFA, properly configured, stop the vast majority of credential-based attacks. You will understand which policies to create, how to roll them out without disrupting your users, and how to handle the inevitable exceptions (shared mailboxes, service accounts, the CEO who refuses to use an authenticator app).

2

Set up email security controls that catch real phishing

You will configure Defender for Office 365 policies, implement email authentication records that stop domain spoofing, and understand the practical difference between the protection levels — instead of just accepting the defaults and hoping for the best.

3

Respond sensibly when a security alert fires

The first time you see a high-severity alert in the Defender portal can be intimidating. You will have a clear process for initial triage, know when to escalate, understand what evidence to preserve, and be able to take initial containment steps with confidence.

4

Report your security posture in terms management understands

Secure Score numbers mean nothing to a finance director. You will learn to translate your security posture into business language: what risks exist, what controls are in place, what improvements are needed, and what they will cost. This is how you get budget approval for the changes you know are necessary.

Time commitment

Roughly 20 to 30 hours of estimated study time. Most people complete it over 4 to 6 weeks at about 5 hours per week. Each module is designed for a single sitting of 30 to 60 minutes.

Where this leads

This course is designed as a stepping stone. Once you are comfortable securing your M365 environment, the M365 Security Operations course takes you into investigation, detection engineering, and threat hunting — the skills that define a SOC analyst role. Many people who start here end up building a career in security operations.

What you get that you will not find elsewhere

This is not a security overview. Overview courses explain concepts. This course teaches IT administrators to configure the security controls they already have access to — conditional access, email authentication, DLP, audit logging — using the M365 admin tools they already know.

Designed for the transition. You are an IT administrator who has been told to "do more security." This course bridges that gap with practical, deployable configurations — not theory, not certifications, not tools you do not have.

Where this course fits

This is the entry point. After completing Admin to Defender, you are ready for any Premium course — Entra ID Security for deep identity architecture, M365 Security Operations for SOC skills, or Detection Engineering for rule building.

100% free. No account required. No subscription needed.

Support and community

Questions about course content: training@ridgelinecyber.com

LinkedIn: Follow Ridgeline Cyber for operational security content and course updates

X: @RidgelineCyber

Version and changelog

Current version: 2.0  |  Last updated: April 2026

April 2026 — v2.0: Inclusive audience statement added. Course page redesigned. All 8 modules at full content standard compliance. 227,000 words across 8 modules.

2026 — v1.0: Course launch. 8 free modules (AD0-AD7) across 3 phases covering identity, email, devices, data, monitoring, incident response, and governance.

This course is actively maintained and updated as the Microsoft 365 security platform evolves.

Start learning now — free, no account needed

All 8 modules are completely free. No account, no credit card, no signup. 227,000 words of practical M365 security training covering identity, email, devices, data, monitoring, incident response, and governance. Start at Module 0 and work through at your own pace.

Start Module 0: The M365 Security Landscape Start Module 1: Securing Identities