0.4 Lab Setup: M365 E5 Developer Tenant

Figure — Lab Setup: M365 E5 Developer Tenant. Applied to security operations at Northgate Engineering.

Lab Setup: M365 E5 Developer Tenant

You need a Microsoft 365 E5 environment to complete the hands-on exercises in this course. This subsection walks you through obtaining and configuring one. Do not skip this — every module from Module 1 onward assumes you have a working tenant.

Your three options

Option 1: M365 Developer Program (if you qualify)

Step 1: Check eligibility. Navigate to developer.microsoft.com/en-us/microsoft-365/dev-program. Sign in with a work, school, or personal Microsoft account. If you see the "Set up E5 subscription" button on your dashboard, you qualify. If you see "You don't currently qualify," move to Option 2 or 3.

Step 2: Choose Instant Sandbox. When prompted, select "Instant sandbox" (not "Configurable sandbox"). The instant sandbox comes pre-provisioned with 24 test users, Microsoft Teams, SharePoint, Outlook, sample data, and all M365 E5 licenses. This saves hours of manual configuration.

Step 3: Note your credentials. The setup process creates an admin account (e.g., admin@yourdomain.onmicrosoft.com) with a password you set. Write these down — you will use them to access the M365 admin center, Defender portal, and Entra ID portal.

Option 2: M365 E5 Trial (30 days, no qualification needed)

Step 1: Navigate to microsoft.com/en-us/microsoft-365/enterprise/e5 and click "Try for free."

Step 2: Follow the sign-up process. You will need a phone number for verification and a credit card (you will not be charged during the trial). Create your admin account and tenant domain.

Step 3: Verify your tenant using the same steps as Option 1 (Steps 4-5).

Option 3: M365 Business Premium or E5 single license

If you want a stable environment that does not expire or require renewal, purchase a single M365 E5 license ($57/month) or M365 Business Premium license ($22/month) through the M365 admin center.

Business Premium vs E5 for this course:

E5 is recommended. Business Premium works for Modules 0-3 and 6-8, but you will hit limitations in Modules that require P2 features. If budget is a concern, start with Business Premium and upgrade to E5 when you reach Module 4.

Creating test users

Regardless of which option you chose, you need test users to simulate a realistic organization. If you used the Instant Sandbox (Option 1), you already have 24 test users. For Options 2 and 3, create at least 6 test users:

Navigate to admin.microsoft.com → Users → Active users → Add a user. Assign each user an M365 E5 license. These fictional users appear throughout the course as the people in our investigation scenarios.

Verification checklist

Before moving to subsection 0.5, confirm all of the following:

• [ ] You can sign into admin.microsoft.com with your admin account
• [ ] You can see active M365 E5 (or Business Premium) licenses
• [ ] You have at least 6 test users with licenses assigned
• [ ] You can access security.microsoft.com (Microsoft Defender XDR portal)
• [ ] You can access entra.microsoft.com (Microsoft Entra admin center)
• [ ] The Defender portal shows the Incidents queue (even if empty)

If any of these fail, wait 30-60 minutes for provisioning to complete. New tenants can take up to 4 hours for all services to activate. If still failing after 4 hours, check the M365 Service Health dashboard at admin.microsoft.com → Health → Service health.

Detection depth: NE-specific implementation

This detection rule addresses a technique that directly threatens NE's operational environment. The implementation accounts for NE's specific infrastructure characteristics:

Telemetry source: The primary data table for this detection ingests approximately 0.5-3.2 GB/day depending on the activity volume. At NE's scale (810 users, 865 devices, 42 servers), the event volume generates a stable baseline that statistical detection methods (percentile analysis from DE9.4) can reliably characterize. Deviations from this baseline represent either environmental changes (new applications, infrastructure modifications) or attacker activity.

Threshold calibration: The threshold was selected using the percentile method: P99 of 30-day historical data establishes the upper bound of normal activity. The production threshold is set at 1.5x P99 to provide margin above normal fluctuation while maintaining detection sensitivity for attack patterns that typically generate 5-50x normal volume.

Developer tenant capabilities and limitations

The E5 developer tenant provides the full Microsoft 365 security stack: Defender for Endpoint (P2), Defender for Office 365 (P2), Defender for Identity, Defender for Cloud Apps, Entra ID P2, and Purview compliance. This matches what a production enterprise tenant includes. The limitation: synthetic sample data does not behave like production data. Automated attacks, user behavior patterns, and alert generation are simulated rather than organic. Detection rules tuned against sample data will require re-tuning when deployed to production because baseline volumes, user counts, and activity patterns differ significantly. Use the developer tenant for learning the portal, writing queries, and testing configurations. Use your production environment (or the NE lab data) for tuning thresholds and validating detection accuracy.

The lab environment configuration decisions you make here directly affect the quality of your learning experience in every subsequent module. Invest the setup time now — a properly configured lab with validated data pipelines means every exercise in the course returns real results. A misconfigured lab means debugging infrastructure instead of learning security operations. Verify each connector before moving to the next module.

The developer tenant renews every 90 days as long as you use it for development activity. If the tenant expires, you lose the configuration but can create a new one. Keep your Sentinel analytics rules, KQL queries, and configuration notes in a separate Git repository so they survive tenant renewal. The course's downloadable KQL packs provide a starting point — import them into each new tenant to restore your detection coverage in minutes rather than rebuilding from scratch.