For Security Engineers, Administrators, and Architects Configuring and Operating the Microsoft Security Stack
Microsoft 365 Security Operations
Configure, detect, investigate, and respond across the entire Microsoft security stack.
Operate Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, Purview, and Sentinel as an integrated security platform. Write production KQL detection rules, build investigation playbooks, deploy hardening baselines, and investigate five real attack types end-to-end — AiTM phishing, BEC, token replay, consent phishing, and insider threat. SC-200 exam objectives fully covered — the certification is the side effect of operational competence.
Text-based · Persistent labs on your own hardware · 2 free modules available now · 36 CPE credits · Content last updated: May 2026
What you'll be able to do
Investigation-first methodology
Every module follows the same pattern: understand the attack technique, investigate it with KQL in Defender XDR and Sentinel, contain and remediate, then deploy detection rules that catch it next time. You leave each module with production artifacts — not just knowledge.
The investigation scenarios are drawn from real incidents: AiTM credential phishing campaigns, BEC payment diversions, consent phishing, token replay, and insider threat. The detection rules, playbooks, and hardening checklists are designed for immediate deployment to your tenant.
Who this course is for
SOC analysts in M365 environments. You triage alerts in Defender XDR and investigate incidents in Sentinel. This course deepens your investigation methodology and gives you deployable detection rules for every major M365 attack type.
Security engineers configuring M365 protection. You manage Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps, and Sentinel. This course teaches you to configure these products for maximum detection coverage with minimal false positives.
IT professionals transitioning to security. You manage an M365 tenant and have been given security responsibility. This course provides the structured methodology to investigate incidents and deploy protection — and maps directly to SC-200 certification.
Anyone with a genuine interest in M365 security operations. Whatever your background — whether you're transitioning from another domain, early in your career, or exploring a new direction — if the subject interests you and you're willing to put in the work, this course is for you. Backgrounds vary. Motivation is what matters.
Deployable artifacts, not study notes
Every module produces something you deploy to your own tenant: KQL analytics rules tested against your data, investigation playbooks with binary decision points, hardening checklists with blast radius and rollback procedures, and IR report templates. 29 deployable detection rules, 5 investigation playbooks, and 5 operational checklists across the course — designed for production use, not just course completion.
What this produces
Production KQL detection rules, investigation playbooks, and hardening baselines deployed across the full Microsoft Defender XDR and Sentinel stack. Five complete attack investigations (AiTM, BEC, token replay, consent phishing, insider threat) with documented procedures — the capability that underpins the SC-200 role and distinguishes "I manage M365" from "I secure M365."
What you will be able to do
1. Investigate security incidents in the Microsoft 365 Defender XDR unified portal — correlating alerts across endpoint, email, identity, and cloud app domains.
2. Write KQL queries for investigation and detection across Defender and Sentinel tables — from basic filtering to advanced cross-table joins and statistical analysis.
3. Configure Defender protection policies — Safe Links, Safe Attachments, anti-phishing, Defender for Endpoint onboarding, and Cloud Apps policies.
4. Design and deploy Sentinel analytics rules that detect real threats — entity mapping, alert grouping, MITRE ATT&CK classification, and automated response.
5. Investigate M365-specific attack scenarios — AiTM phishing, BEC, consent phishing, token replay, ransomware pre-encryption, and insider threat.
6. Pass the SC-200 certification exam — every module maps to SC-200 objectives with hands-on experience that makes the multiple-choice exam straightforward.
Course at a glance
Modules: 17 across 4 phases
Estimated duration: 32–40 hours (self-paced)
Format: Written content — annotated KQL queries, SVG diagrams, worked artifacts, knowledge checks
Free content: Modules 0–1 — no account required
Paid content: Modules 2–16 — Premium or Team subscription
Certification: Every module maps to SC-200 exam objectives (January 2026 update)
Typical pace: ~5-10 weeks at 5 hrs/week
Hands-on labs: 8 interactive (browse all →)
MITRE ATT&CK coverage: 52 techniques mapped
Built by Ridgeline Cyber
Ridgeline Cyber Defence builds security operations training grounded in practical and operational experience. The team behind this course runs CSOC operations across on-prem, Splunk, and Microsoft 365 security stacks, Cisco and Palo Alto networks, and managed SOC partnerships.
Experience spans detection engineering, incident response, and DFIR investigation across on-prem, M365, and Linux environments — including leading cyber incident response engagements, deploying security controls and managing Governance, Risk and Compliance operations.
The investigation scenarios in this course are grounded in that operational work. The techniques, decision points, and mistakes are drawn from real investigations, sanitized and adapted for training.
What this course does NOT cover
Deliberate scope boundaries. If any of these is your primary need, the sibling course is the better fit.
- Deep incident response investigation — see Practical Incident Response: Windows & M365
- Detection rule engineering — see Detection Engineering
- Proactive threat hunting — see Practical Threat Hunting in Microsoft 365
Technical requirements
M365 Developer Tenant (free): From developer.microsoft.com — 25 user licenses, E5 environment, sample data packs. Setup instructions in Module 0. No lab needed for free modules.
KQL editor: Sentinel Log Analytics or Defender XDR advanced hunting portal — both included in the developer tenant.
No commercial tools required. Everything runs in the M365 portal.
How to get the most from this course
Recommended pace: 1–2 modules per week, 32–40 hours total over 8–12 weeks alongside a full-time role.
Work through phases in order. If you already have KQL and SOC experience, jump to Phase 2 or 3 — but read Module 1 regardless. Experienced analysts can go straight to Phase 4 investigation scenarios.
Deploy every artifact. Run the KQL queries against your own tenant. Deploy the detection rules. The course produces real security value when you deploy, not just when you read.
Support and community
Questions about course content: training@ridgelinecyber.com
Billing and account management: Self-service via your account page or training@ridgelinecyber.com
LinkedIn: Follow Ridgeline Cyber for operational security content and course updates
Course Syllabus
Four phases. Modules 0–1 are free — no account required.
Free Phase 1 — Foundations
00Phase 2 — Microsoft Security Stack
02Phase 3 — Sentinel Operations
06Phase 4 — Investigation Scenarios
12What you get that you will not find elsewhere
This is not a product overview. Product overviews explain features. This course teaches how to operate the M365 security stack as an integrated detection and response platform — Sentinel, Defender XDR, Defender for Office 365, Defender for Cloud Apps, and Entra ID Protection working together.
Cross-workload investigation. Real incidents span email, identity, endpoint, and cloud apps. This course teaches investigation across all four workloads using the unified incident queue and Advanced Hunting.
Mapped to SC-200. The course content aligns to Microsoft SC-200 exam objectives — but teaches at operational depth, not exam-prep depth.
Where this course fits
Entra ID Security engineers the identity layer. This course operates the security stack that monitors it.
Detection Engineering builds custom rules. This course teaches the operational context — alert queues, incident management, and cross-workload correlation — that those rules feed into.
Practical IR investigates incidents. This course teaches the M365-specific tools and data sources that IR uses.
Recommended learning path: M365 SecOps → Entra ID → DE → IR. A learner can start at any course.
The outcome
You start navigating the portal. You finish operating the platform.
Cross-workload investigation — trace attacks across email, identity, endpoint, and cloud apps.
Unified incident management — triage, investigate, and respond from a single queue.
Advanced Hunting fluency — KQL queries across all Microsoft security data tables.
Prerequisites
Required: 1+ years in IT administration, helpdesk, or a junior security role. Access to a Microsoft 365 tenant (production or developer). Familiarity with the M365 admin center.
Recommended: Basic KQL experience (where, project, summarize). The free modules (Phase 1) cover platform orientation and KQL fundamentals.
Usage rights and disclaimer
Course materials: Licensed for individual professional development. You may use scripts, queries, detection rules, templates, and frameworks from this course in your professional work. You may not redistribute course content, share account credentials, or republish course materials.
Fictional environment: All scenarios use the fictional Northgate Engineering environment. Any resemblance to real organizations, incidents, or individuals is coincidental.
No legal advice: Compliance and regulatory content in this course is educational, not legal advice. Consult qualified legal counsel for obligations in your jurisdiction.
Version and changelog
Current version: 1.0 | Last updated: 2026
2026 — v1.0: Complete course. All 17 modules active across 4 phases. Mapped to SC-200 exam objectives (January 2026 update). Investigation scenarios: AiTM phishing, BEC, token replay, consent phishing, insider threat.
This course is actively maintained. Content is updated as the security landscape evolves.
End of Course Exam
Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.
Requires 80% course completion. One random scenario per attempt. Certificate issued on pass.