Microsoft Entra ID Security

The Defense Design Method

Every module applies the same structured 6-step method: understand the threat, assess the current state, design the control, implement with rollback, verify with KQL, and document for operations. Identity security designed for production — not just configured for compliance.

Who this course is for

Identity and access administrators. You manage Entra ID and conditional access. This course teaches you to design identity security controls that stop real attacks while maintaining user productivity.

Security engineers hardening M365 identity. You need to close the identity attack surface — phishing-resistant MFA, token protection, PIM, workload identity security. This course provides the methodology.

SOC analysts investigating identity-based attacks. You see the sign-in anomalies and need to trace them through authentication events, token operations, and administrative changes.

Anyone with a genuine interest in Entra ID security. Whatever your background — whether you're transitioning from another domain, early in your career, or exploring a new direction — if the subject interests you and you're willing to put in the work, this course is for you. Backgrounds vary. Motivation is what matters.

Course at a glance

Modules: 19 (EI0–EI18) across 4 phases

Estimated duration: 36–40 hours (self-paced)

Format: Written content — annotated KQL queries, SVG diagrams, worked artifacts, knowledge checks

Free content: EI0–EI2 (3 modules) — no account required

Paid content: EI3–EI18 (16 modules) — Premium or Team subscription

Core methodology: Defense Design Method (6 steps) applied across all modules

Typical pace: ~5-10 weeks at 5 hrs/week

MITRE ATT&CK coverage: 35 techniques mapped

Built by Ridgeline Cyber

Ridgeline Cyber Defence builds security operations training grounded in practical and operational experience. The team behind this course runs CSOC operations across on-prem, Splunk, and Microsoft 365 security stacks, Cisco and Palo Alto networks, and managed SOC partnerships.

Experience spans detection engineering, incident response, and DFIR investigation across on-prem, M365, and Linux environments — including leading cyber incident response engagements, deploying security controls and managing Governance, Risk and Compliance operations.

The investigation scenarios in this course are grounded in that operational work. The techniques, decision points, and mistakes are drawn from real investigations, sanitized and adapted for training.

How to get the most from this course

Recommended pace: 1–2 modules per week, 36–40 hours total over 8–12 weeks.

EI0–EI2 are sequential. They establish the threat landscape and methodology. EI3 onward can be prioritized based on your most urgent identity security gaps.

Apply the Defense Design Method to your own tenant. Run the same analysis against your production Entra ID tenant to produce real security improvements.

Support and community

Questions about course content: training@ridgelinecyber.com

Billing and account management: Self-service via your account page or training@ridgelinecyber.com

LinkedIn: Follow Ridgeline Cyber for operational security content and course updates

X: @RidgelineCyber

Where this course fits

Endpoint Security secures the device layer. This course secures the identity layer — the layer that determines who gets in and what they can do once they are in.

Practical IR investigates identity compromise after the breach. This course builds the controls and detections that prevent the breach or catch it early.

M365 Security Operations operates the M365 security stack. This course engineers the identity architecture that stack depends on.

Recommended learning path: Entra ID Security → Endpoint Security → DE → IR. A learner can start at any course.

The outcome

You start with default conditional access and hope MFA is enough. You finish with a designed identity security architecture.

Phishing-resistant authentication — deployed and validated against AiTM, device code phishing, and OAuth consent abuse.

Conditional access that blocks real attacks — not checkbox compliance, but policies mapped to specific attack techniques with verification queries.

Identity detection rules — KQL analytics for token replay, privilege escalation, persistence, and service principal abuse.

A complete identity security architecture document — deployable, auditable, and defensible.