M365 Security Architecture

The Design-Justify-Implement-Validate Cycle

Every module in this course follows the same four-stage cycle that separates architecture from configuration:

1. Design. Analyse the architectural problem with real-world constraints — E3 vs E5 licensing, legacy applications, hybrid AD, political resistance, service accounts vendors refuse to update. Design a solution that works within those constraints.

2. Justify. Document the decision as an Architecture Decision Record — context, decision, alternatives rejected, consequences, residual risk, and the 30-second version for your CISO. The documentation is what makes it architecture, not configuration.

3. Implement. Build the solution in your M365 E5 developer tenant. Portal configurations first, then PowerShell for automation and verification. Every implementation includes a verification step — query the API, confirm the setting is active.

4. Validate. Test whether the implementation achieves what the design intended. Attack simulations, CA What If evaluations, sign-in log analysis. If the control doesn't stop what it's supposed to stop, you find out in your lab — not during an incident.

Who this course is for

Security architects designing M365 security posture — you need a methodology for making connected decisions across identity, access, data, endpoints, and detection, and documenting those decisions for auditors and leadership.

Security engineers moving from reactive to proactive — you handle alerts and incidents, and you've noticed the same architectural gaps cause repeated incidents. You want to design the controls that prevent incidents instead of investigating them after they happen.

M365 administrators given security responsibility — you can configure MFA, CA, and Defender policies, but you can't explain why one configuration is better than another or present that case to your CISO.

GRC analysts who need architecture evidence — you map controls to ISO 27001, SOC 2, and Cyber Essentials but struggle to get documented evidence from the security team. This course produces the ADRs and risk register entries that satisfy audit requirements.

Anyone with a genuine interest in M365 security architecture. Whatever your background — early career, transitioning from another domain, or expanding your skill set — if the subject interests you and you're willing to do the work, this course is for you. Backgrounds vary. Motivation is what matters.

Course at a glance

Modules: 15 (MSA0–MSA14)

Phases: 4 (Identity Foundation → Protection Stack → Detection and Response → Governance and Capstone)

Estimated study time: 36–40 hours

Content subs: 175+ across all modules

ADRs produced: 30+

Decision matrices: 7

Risk register entries: 25+

Architecture diagrams: 14 (one per module minimum)

CPE credits: 40

Free modules: MSA0 + MSA1 (no account required)

Lab: M365 E5 developer tenant + Azure subscription (yours to keep)

Typical pace: ~5-10 weeks at 5 hrs/week

Built by Ridgeline Cyber

Ridgeline Cyber Defence builds security operations training grounded in practical and operational experience. The team behind this course runs CSOC operations across M365 security stacks, manages Sentinel and Defender XDR environments, and designs security architecture for production tenants.

This course isn't based on vendor documentation repackaged as training. It's based on the architecture decisions we make in production — the same trade-offs, constraints, and documentation requirements you face. Every anti-pattern box ("what we see in 90% of tenants") comes from real assessment findings. Every decision matrix comes from real architecture projects. Every ADR template comes from the documentation we produce for our own clients.

The course is text-based. No videos, no live sessions, no cohorts. You work at your own pace, on your own schedule, with content you can search, reference, and return to. The format is deliberate — security architecture is a reading and doing discipline, not a watching discipline.

The outcome

You start with a default M365 tenant where every security setting is either off or at Microsoft defaults. You finish with:

A complete identity architecture — every identity type catalogued, hybrid decisions documented, administrative units scoped, lifecycle automated, stale identities remediated.

Phishing-resistant authentication — passkeys deployed, legacy authentication blocked, service accounts governed, token theft mitigated.

A Conditional Access framework — 15 policies covering four personas, three tiers, and application-specific controls. Every policy documented with an ADR. Break-glass tested and monitored.

Privilege architecture — standing privilege reduced by 85%+. PIM with meaningful activation policies. Service principals governed. Copilot secured.

Data protection, detection, and response — sensitivity labels applied, DLP enforced, Sentinel workspace designed, detection rules prioritized, incident response playbooks documented.

An executive-ready architecture package — the document your CISO presents to the board, your GRC analyst gives to auditors, and your successor uses to understand every decision you made.

At $289/year, this is less than a single day of instructor-led training — for a complete security architecture program you work through at your own pace and reference permanently.

Where this course fits

This course designs the controls. Other Ridgeline courses operate within them:

Admin to Defender (free) covers M365 basics. MSA assumes this level or teaches inline.

Practical IR investigates when controls fail. MSA designs the controls.

Detection Engineering writes detection rules. MSA designs the detection architecture.

Endpoint Security tunes MDE. MSA designs the endpoint trust architecture that feeds CA.

Purple Teaming validates techniques. MSA uses those techniques to validate architectural controls.

Conditional Access (skill) covers 7 subs. MSA3 covers 13 subs with full architectural context.

Learner ladder: Admin to Defender (basics) → M365 Security Architecture (design layer) → Detection Engineering + Endpoint Security (operational layer) → Practical IR (investigation layer)

Support and community

Questions about course content: training@ridgelinecyber.com

Billing and account management: Self-service via your account page or training@ridgelinecyber.com

LinkedIn: Follow Ridgeline Cyber for operational security content and course updates

X: @RidgelineCyber

Usage rights and disclaimer

Course materials: Licensed for individual professional development. You may deploy configurations, detection rules, scripts, and policies from this course in your organization's production environment. You may not redistribute course content, share account credentials, or republish course materials.

Architecture configurations: All PowerShell commands, Graph API queries, Conditional Access policies, PIM configurations, and Purview policies are provided as-is for deployment in your environment. Test every configuration in report-only or simulation mode before enforcement. Security controls have production impact — validate blast radius before deployment. Ridgeline Cyber Defence is not responsible for operational impact from deployed configurations.

Scenarios: All example data uses generic tenant references and RFC 5737 documentation IP ranges. Any resemblance to real organizations, incidents, or individuals is coincidental.