EI0.10 Course Structure and Learning Path

EI2 (Authentication Methods) is required before EI4. You need to understand the authentication method hierarchy before you can design conditional access policies that enforce specific methods.

EI3 (CA Architecture) is required before EI4 and EI8. You need to understand how conditional access evaluation works before you build attack-specific policies or validate their enforcement.

EI5 (Identity Protection) is required before EI13. The detection engineering module builds on the risk signals that Identity Protection produces.

EI9-EI12 are relatively independent. Phase 3 modules can be taken in any order, though EI9 (Application Security) provides context that enriches EI10 (Workload Identity).

EI13-EI16 can be taken in any order but all assume completion of Phases 1-2.

EI17 (Complete Architecture) requires completion of all prior modules. It synthesizes everything into the final design.

SOC analyst defending identity (estimated 20-25 hours, focused path): Start with EI0 → EI1 (sign-in log fluency is your primary skill). Then EI5 (Identity Protection — you triage risk alerts daily). Then EI3 and EI4 (understand the CA policies you are monitoring). Then EI13 (detection engineering — build the rules you want in your SOC). Then EI16 (Defender XDR integration). Add EI7 (token security) and EI9 (application security) as time permits — these are the attack surfaces you will investigate most frequently.

Security engineer designing identity controls (estimated 30-35 hours): Follow the full course but prioritize Phase 2 (EI3-EI8) — this is your core work. Then Phase 3 (EI9-EI12) for governance. Then EI17 (the complete architecture) which gives you the deployable design document. Add Phase 4 detection modules as time permits.

IR practitioner adding prevention skills (estimated 15-20 hours, targeted): Start with EI0 → EI1 (sign-in log skills complement your investigation skills). Then EI4 (understand what should have stopped the attacks you investigate). Then EI7 (token security — connects directly to your token theft investigation work). Then EI9 (application security — the persistence mechanisms you find in investigations). Then EI13 (detection engineering — close the loop from investigation findings to prevention).

Phase 3 modules (EI9-EI12) are governance-focused — they involve application auditing, access reviews, and lifecycle workflows. Estimated 60-90 minutes each.

Phase 4 modules (EI13-EI17) are the most advanced — EI13 (detection engineering) is the deepest technical module in the course, and EI17 (complete architecture) is the capstone that synthesizes everything. Estimated 60-120 minutes each.

Microsoft 365 Security Operations covers the broader Defender XDR ecosystem. This course focuses on Entra ID specifically; the M365 SecOps course covers Defender for Endpoint, Defender for Office 365, Sentinel, and the unified investigation experience. EI16 (Defender XDR integration) is the bridge module.

Mastering KQL for Cybersecurity provides the query skills used throughout this course. EI1 teaches the KQL patterns specific to identity security, but learners who want deeper KQL fluency should take the dedicated KQL course.

SOC Operations provides the operational tooling — detection rule packs, playbooks, and templates — that complements the identity-specific detection rules built in EI13.

Practical GRC for Security Professionals provides the governance framework. EI12 (Identity Governance) produces the access review and lifecycle evidence that the GRC course teaches you to present to auditors and board members.

EI2 (Authentication Methods) produces an authentication method migration plan — a phased roadmap for moving your organization from password-based authentication to phishing-resistant credentials, with specific timelines and communication templates.

EI3 (Conditional Access Architecture) produces a complete conditional access policy set — the specific policies your environment needs, designed with the Zero Trust framework, including emergency access procedures and named location configuration.

EI4 (Stopping Real Attacks) produces attack-specific policy additions — the conditional access configurations that stop AiTM, password spray, MFA fatigue, token theft, consent phishing, and legacy authentication exploitation. Each includes verification queries.

EI5 (Identity Protection) produces configured risk policies — user risk and sign-in risk policies tuned for your environment, with a documented triage workflow for the daily risky users review.

EI6 (PIM) produces a privileged access strategy — PIM configuration for all critical directory roles, activation requirements, and monitoring alerts for suspicious role activations.

EI7 (Token Security) produces a token protection deployment plan — the rollout methodology for binding tokens to devices, including the report-only analysis and phased enforcement strategy.

EI8 (CA Validation) produces a conditional access validation report — the evidence that every policy is working as designed, with gap analysis identifying users and applications not covered by any policy.

EI9 (Application Security) produces an application registration audit — every application in your tenant reviewed for excessive permissions, expired credentials, missing owners, and consent governance configuration.

EI10 (Workload Identity) produces a workload identity inventory — every service principal classified by authentication method, permissions, and monitoring coverage, with a remediation plan for those using client secrets.

EI11 (External Identities) produces a B2B access governance framework — cross-tenant access settings, conditional access policies for external users, and a guest user review process.

EI12 (Identity Governance) produces access review configurations and lifecycle workflow automation — recurring reviews for privileged roles and sensitive groups, plus automated onboarding and offboarding procedures.

EI13 (Detection Engineering) produces a complete identity detection rule library — KQL-based Sentinel analytics rules for every identity attack technique, each mapped to MITRE ATT&CK, with severity classifications and response actions.

EI14 (Monitoring) produces an operational monitoring framework — the daily, weekly, and monthly review procedures for identity security posture, plus a leadership reporting template.

EI15 (Backup/Recovery) produces a conditional access backup and identity resilience plan — exported policy configurations, recovery procedures, and a compromised tenant response runbook.

EI16 (Defender XDR) produces an integrated SOC workflow — the triage and escalation procedures for identity alerts in the unified Defender XDR incident queue.

EI17 (Complete Architecture) produces the final deliverable: a complete identity security architecture document for your environment — every policy, every configuration, every detection rule, every monitoring procedure assembled into a single deployable design with a 90-day implementation roadmap.

Every artifact is designed to be adapted for your production environment. The lab exercises create the artifact in the developer tenant; the worked examples show you how to adapt it for production deployment.

Incident investigation methodology. This course teaches you to prevent identity compromises and detect when prevention fails, but it does not teach you how to investigate a confirmed compromise end-to-end. That is the IR course's domain. The cross-references throughout this course tell you exactly which IR module covers the investigation side of each attack technique — so when you detect a compromised account, you know where to go for the investigation methodology.

Entra External ID and customer identity (CIAM). This course covers workforce identity — the users, administrators, and service principals in your organizational tenant. Customer-facing identity scenarios (Azure AD B2C, Entra External ID) have a different threat model, different controls, and different architecture considerations that are not covered here.

On-premises Active Directory security in depth. While the hybrid identity section in EI0.1 describes the attack paths that span on-premises and cloud environments, and EI16 covers Defender for Identity integration, this course does not provide comprehensive on-premises AD hardening or attack detection. The IR course covers on-premises forensics in Phases 2-3 (IR3-IR7).

Network security and endpoint security. Conditional access evaluates device compliance and network location as signals, but the configuration of endpoint protection (Defender for Endpoint) and network security (firewalls, proxies, Global Secure Access) is covered in the M365 Security Operations course and SOC Operations course respectively.