Ridgeline Cyber

M365 Security Operations M365 Security: From Admin to Defender SOC Analyst Operations

Get Started Free

Introduction 0.1 Mission and Course Blueprint 0.1 Mission, Course Structure, and Who This Is For 0.2 SC-200 Exam Overview and Study Strategy 0.2 Who This Course Is For 0.3 Curriculum Breakdown 0.3 How to Learn from This Course 0.4 How to Learn from This Course 0.4 Lab Setup: M365 E5 Developer Tenant 0.5 Lab Environment, Resources, and Support 0.5 Lab Setup: Azure Subscription and Sentinel Workspace 0.6 Lab Setup: Sample Data and Validation 0.7 Module Summary 0.8 Check My Knowledge

Introduction 1.1 Introduction to Microsoft Defender XDR Threat Protection 1.2 Mitigate Incidents Using Microsoft Defender XDR 1.3 Remediate Risks with Microsoft Defender for Office 365 1.4 Manage Microsoft Defender for Endpoint Investigations 1.5 Mitigate Threats Using Microsoft Defender for Identity 1.6 Secure Cloud Apps with Microsoft Defender for Cloud Apps 1.7 Unified Portal Operations: Daily SOC Workflow 1.8 Cross-Product Incident Correlation 1.9 Module Summary 1.10 Check My Knowledge

Introduction 1.1 Defender for Endpoint 1.2 Defender for Office 365 1.3 Defender for Identity 1.4 Defender for Cloud Apps 1.5 Entra ID Protection 1.6 Microsoft Sentinel 1.7 Microsoft Purview 1.8 Microsoft Intune 1.9 Microsoft Defender XDR 1.10 How the Ecosystem Integrates 1.11 Licensing, Lab Setup, and Module Assessment

Introduction 2.1 How KQL Works and Key Tables 2.2 Core Operators 2.3 Time Functions and Joins 2.4 Parsing Semi-Structured Data 2.5 Investigation Patterns and Query Organization 2.6 Exam Relevance and References

Introduction 3.1 Portal Layout and Incident Hierarchy 3.2 Working the Incident Queue 3.3 Advanced Hunting 3.4 Response Actions and Automation 3.5 Notifications, RBAC, and Exam Relevance 3.6 Threat Analytics 3.7 Secure Score and Exposure Management 3.8 Email Investigation with Threat Explorer 3.9 Device Investigation Page 3.10 Module Assessment

Introduction 4.1 Two Tables, Not One 4.2 Key Fields in the Sign-In Log 4.3 Investigation Patterns 4.4 Reading a Sign-In Event 4.5 Volume Management and Exam Relevance 4.6 Conditional Access Analysis 4.7 Legacy Authentication Detection 4.8 Token Replay Investigation 4.9 Building Sign-In Baselines 4.10 Module Assessment

Introduction 6.1 Construct KQL Statements for Microsoft Sentinel 6.2 Analyze Query Results Using KQL 6.3 Build Multi-Table Statements Using KQL 6.4 Work with String Data in KQL 6.5 Security-Specific KQL Patterns 6.6 Building an Investigation Query Library 6.7 KQL Performance Optimization and Query Debugging 6.8 Real-World Query Building Exercises 6.9 Module Summary 6.10 Check My Knowledge

Your progress

Loading...

Module : Paid Modules

Sections in this module

Ridgeline Cyber Defence

Practical M365 security training, toolkits, and services for the people who defend organisations.

Training

Courses Labs Resources Pricing

Company

About Subscribe ridgelinecyber.com

Legal

Privacy Policy Terms of Service Refund Policy

© 2026 Ridgeline Cyber Defence Ltd. All rights reserved.