For M365 administrators with security responsibility, SOC analysts defending identity, and security engineers designing identity controls
Microsoft Entra ID Security
Every cloud attack starts with identity. This course teaches you to stop it there.
There are courses that teach Entra ID administration and courses that teach cloud incident response. Nothing teaches the security-focused middle ground — how to harden Entra ID to prevent attacks, how to design conditional access policies that actually stop AiTM, how to deploy phishing-resistant authentication, how to protect tokens from theft, and how to detect identity-based attacks in real time. This course fills that gap. Every defense follows the same systematic method: what attack does this stop, where is the control configured, how should it be designed, how do you verify it works, what does failure look like, and what do you do next.
The Defense Design Method
Every identity security control in this course — from a conditional access policy to a detection rule — follows the same systematic six-step pattern:
1. What attack does this stop? — The specific threat technique, named and mapped to MITRE ATT&CK. Not a vague risk category.
2. Where is the control configured? — The exact portal path, PowerShell command, or Graph API endpoint. No ambiguity about location.
3. How should it be designed? — The policy logic: who it applies to, what conditions trigger it, what exceptions are needed, and why.
4. How do you verify it works? — The KQL query against sign-in logs or audit logs that proves the control is active and enforcing.
5. What does it look like when it fails? — The log entry, the alert, the audit event that tells you something got through a gap.
6. What do you do next? — The remediation action, the escalation path, and the bridge to the IR course for full investigation.
This method is the course's intellectual backbone. A learner who internalizes it can design identity security controls for any environment — because the method is systematic, not tool-dependent.
Who this course is for
M365 administrators who own security. You manage the tenant. Someone decided you are also responsible for securing it. You know how to configure Entra ID — you need to learn how to defend it. This course bridges that gap without burying you in generic cybersecurity theory.
SOC analysts defending identity. You triage identity alerts in Defender XDR. You see risky sign-ins and conditional access failures. This course teaches you what those controls should look like when they are designed correctly — so you know the difference between a misconfiguration and an attack.
Security engineers designing identity controls. You need to build a conditional access architecture, deploy phishing-resistant authentication, govern application registrations, and detect identity-based attacks. This course provides the complete design, the deployment methodology, and the verification queries.
IR practitioners who want to prevent the incidents they investigate. You have completed the IR course. You know how to investigate AiTM, token theft, and consent phishing. This course teaches you to deploy the controls that stop those attacks from succeeding in the first place.
The course that does not exist elsewhere
There are SC-300 courses that teach Entra ID administration — how to create users, configure MFA, and set up conditional access policies. There are SC-200 courses that teach investigation — how to query sign-in logs and investigate incidents in Defender XDR. There are vendor whitepapers that describe identity security best practices in generic terms.
Nothing teaches the operational middle ground: how to design a conditional access architecture that actually stops AiTM credential phishing. How to deploy token protection so stolen session tokens are useless. How to govern application registrations so consent phishing cannot grant an attacker Mail.ReadWrite. How to build KQL detection rules that catch privilege escalation in real time. How to verify — with evidence — that every control you deployed is actually working.
This course fills that gap. It is the "how to prevent the incident" companion to the IR course's "how to investigate the incident."
Course syllabus
Four phases from identity foundations through complete architecture design. Free modules let you start immediately.
Phase 1 — Foundations (EI0-EI2, FREE): The identity threat landscape, sign-in log fluency, and authentication methods from passwords to phishing-resistant credentials.
Phase 2 — Conditional Access and Identity Protection (EI3-EI8): Conditional access architecture and design, stopping real attacks with specific policy combinations, Identity Protection risk-based defense, privileged identity management, token security, and CA validation.
Phase 3 — Application and Workload Identity Security (EI9-EI12): Application registration governance, managed identities and workload identity security, external identities and B2B security, and identity governance and lifecycle management.
Phase 4 — Detection, Monitoring, and Operations (EI13-EI17): Identity detection engineering with KQL, operational monitoring, backup and recovery, Defender XDR integration, and the complete identity security architecture design.
Cross-course connections
This course is designed to work alongside the rest of the Ridgeline curriculum:
Practical Incident Response — This course teaches prevention; the IR course teaches investigation. Conditional access design connects to CA bypass investigation. Token protection connects to token theft forensics. Identity Protection connects to risk-based investigation.
M365 Security Operations — Sign-in log analysis for hardening connects to sign-in log analysis for investigation. Detection rules connect to Sentinel analytics. Identity Protection connects to risk-based alerting.
SOC Operations — Identity detection rules feed the SOC detection library. Application governance connects to application-based detection. Monitoring workflows connect to SOC operational procedures.
Practical GRC — Identity governance maps directly to compliance frameworks. PIM access reviews generate audit evidence. The compliance mapping in EI17 connects to GRC framework implementation.
What you need
Prerequisites: Basic M365 administration familiarity. You should know how to navigate the Entra admin center and understand what users, groups, and applications are. No prior Entra ID security experience required.
Lab environment: A free M365 E5 developer tenant from developer.microsoft.com with a free Azure subscription. Total cost: $0. The free modules do not require a lab. Paid modules include hands-on exercises in your developer tenant.
Recommended: A FIDO2 security key for the phishing-resistant authentication modules. Not required but valuable for hands-on practice with the authentication methods you will be deploying.
Start with the identity threat landscape
Free modules. No account required. Understand why identity is the attack surface that matters most — then build the defenses that stop it.