Microsoft 365 Security Operations

  <div class="glance-card">
    <h3>Overview</h3>
    <p>This is a hands-on training course for security professionals working in Microsoft 365 environments. You will learn to investigate real attack scenarios — from the moment an alert fires through containment, eradication, and the final incident report on your CISO's desk.</p>
    <p>The course covers the full Microsoft security stack: Sentinel, Defender XDR, Defender for Endpoint, Defender for Office 365, Entra ID Protection, Defender for Cloud Apps, and Purview. You will write KQL queries, build detection rules, configure security policies, and work through complete investigation scenarios based on attacks that actually happen in production environments.</p>
    <p>This is not a slide deck walkthrough or a video course where someone reads documentation at you. Every module is written content — searchable, bookmarkable, and designed to be referenced during a live investigation at two in the morning. The KQL queries work. The detection rules are deployable. The investigation playbooks follow the same structure used in real SOC operations.</p>
    <p>The content aligns with the SC-200 Microsoft Security Operations Analyst certification objectives, but the goal is operational competence, not exam memorisation. If you can investigate an AiTM phishing campaign end-to-end, the certification exam is straightforward.</p>
  </div>

  <div class="glance-card">
    <h3>Audience profile</h3>
    <p><strong>This course is built for you if:</strong></p>
    <p>You work in a SOC or security team that uses Microsoft 365 and you want to sharpen your investigation and detection engineering skills. Maybe you have been triaging alerts for six months and you are ready to go deeper — to understand the full attack chain, write your own KQL queries, and build detection rules instead of relying on out-of-the-box content.</p>
    <p>Or you are an IT administrator who has been handed security responsibilities on top of your existing role. You know your way around the M365 admin centre, but the Defender portal and Sentinel feel like unfamiliar territory. You need structured guidance from someone who has been where you are.</p>
    <p>Or you are an MSP technician managing security for multiple client tenants. You need repeatable investigation workflows and detection rules you can deploy across environments.</p>
    <p><strong>Prerequisites:</strong> Basic familiarity with Microsoft 365 administration. You should know what Entra ID is, understand the basics of Exchange Online, and be comfortable navigating browser-based admin portals. No prior security experience or KQL knowledge required — the course teaches both from the ground up.</p>
  </div>

  <div class="glance-card full-width">
    <h3>Course syllabus</h3>
    <div class="syllabus-phases">
      <div class="syllabus-phase">
        <div class="syllabus-phase-header">
          <span class="phase-badge free">Free — Start Now</span>
          <h4>Phase 1: Foundations</h4>
          <p>Four modules that give you the vocabulary, the primary investigation tool (KQL), and your first hands-on investigation skill. No account needed. No email gate. Read them right now.</p>
        </div>
        <div class="syllabus-modules">
          <a href="/modules/free/01-m365-security-ecosystem/" class="syllabus-module">
            <span class="sm-num">01</span>
            <div><strong>The M365 Security Ecosystem</strong> — A technical map of every component in Microsoft's security stack. What each service does, what data it produces, and how they connect to each other. The reference you will return to throughout the course.</div>
          </a>
          <a href="/modules/free/02-kql-fundamentals/" class="syllabus-module">
            <span class="sm-num">02</span>
            <div><strong>KQL Fundamentals for Security Analysts</strong> — The query language that drives everything in Sentinel and Defender XDR. Operators, functions, joins, and 14 investigation patterns you will use in every module that follows.</div>
          </a>
          <a href="/modules/free/03-defender-xdr-navigation/" class="syllabus-module">
            <span class="sm-num">03</span>
            <div><strong>Defender XDR Portal Navigation</strong> — How the unified security portal is organised. Incident queues, alert management, advanced hunting, and the response actions available to you. Know where everything is before your first real alert.</div>
          </a>
          <a href="/modules/free/04-entra-signin-log-analysis/" class="syllabus-module">
            <span class="sm-num">04</span>
            <div><strong>Entra ID Sign-In Log Analysis</strong> — Your first investigation skill. Every compromise investigation starts here. You will learn to read sign-in logs, identify anomalies, and write KQL queries that surface compromised accounts.</div>
          </a>
        </div>
      </div>

      <div class="syllabus-phase">
        <h4>Phase 2: Environment and Configuration</h4>
        <p>Eight modules covering Sentinel workspace design, data connectors, Defender for Endpoint and Office 365 configuration, analytics rule creation, cloud workload protection, and exposure management. You will configure the security infrastructure that detection and investigation depend on.</p>
      </div>

      <div class="syllabus-phase">
        <h4>Phase 3: Investigation and Response</h4>
        <p>Ten investigation scenario modules — the heart of the course. Each one walks you through a complete real-world attack from initial alert through containment, eradication, and reporting. Scenarios include AiTM credential phishing, business email compromise, consent phishing, token replay, ransomware pre-encryption, insider threat, and cross-domain investigation.</p>
      </div>

      <div class="syllabus-phase">
        <h4>Phase 4: Threat Hunting and Advanced</h4>
        <p>Six modules on proactive threat hunting with KQL, threat intelligence integration, MITRE ATT&CK mapping, Sentinel automation with playbooks, security reporting with workbooks, and Security Copilot for SOC operations.</p>
      </div>
    </div>
  </div>
</div>