Microsoft Security Engineer Training - United Kingdom

Microsoft Security Operations Analyst SC200 Course Outline

Module 1: Introduction to Microsoft 365 Threat Protection

• Introduction
• Explore Extended Detection and Response (XDR) Response Use Cases
• Understand Microsoft 365 Defender in a Security Operations Centre (SOC)
• Explore Microsoft Security Graph
• Investigate Security Incident in Microsoft 365 Defender

Module 2: Mitigate Incidents Using Microsoft 365 Defender

• Introduction
• Use the Microsoft 365 Defender Portal
• Manage Incidents
• Investigate Incidents
• Manage and Investigate Alerts
• Manage Automated Investigations
• Use the Action Centre
• Explore Advanced Hunting
• Investigate Azure AD Sign-In Logs
• Understand Microsoft Secure Score
• Analyse Threat Analytics
• Analyse Reports
• Configure the Microsoft 365 Defender Portal

Module 3: Protect Your Identities with Azure AD Identity Protection

• Introduction
• Azure AD Identity Protection Overview
• Detect Risks with Azure AD Identity Protection Policies
• Investigate and Remediate Risks Detected by Azure AD Identity Protection

Module 4: Remediate Risks with Microsoft Defender for Office 365

• Introduction to Microsoft Defender for Office 365
• Automate, Investigate, and Remediate
• Configure, Protect, and Detect
• Simulate Attacks

Module 5: Safeguard Your Environment with Microsoft Defender for Identity

• Introduction to Microsoft Defender for Identity
• Configure Microsoft Defender for Identity Sensors
• Review Compromised Accounts or Data
• Integrate with Other Microsoft Tools

Module 6: Secure Your Cloud Apps and Services with Microsoft Defender for Cloud Apps

• Introduction
• Understand the Defender for Cloud Apps Framework
• Explore Your Cloud Apps with Cloud Discovery
• Protect Your Data and Apps with Conditional Access App Control
• Walk Through Discovery and Access Control with Microsoft Defender for Cloud Apps
• Classify and Protect Sensitive Information
• Detect Threats

Module 7: Respond to Data Loss Prevention Alerts Using Microsoft 365

• Introduction
• Describe Data Loss Prevention Alerts
• Investigate Data Loss Prevention Alerts in Microsoft Purview
• Investigate Data Loss Prevention Alerts in Microsoft Defender for Cloud Apps

Module 8: Manage Insider Risk in Microsoft Purview

• Insider Risk Management Overview
• Introduction to Managing Insider Risk Policies
• Create and Manage Insider Risk Policies
• Knowledge Check
• Investigate Insider Risk Alerts
• Take Action on Insider Risk Alerts through Cases
• Manage Insider Risk Management Forensic Evidence
• Create Insider Risk Management Notice Templates

Module 9: Investigate Threats by Using Audit Features in Microsoft 365 Defender and Microsoft Purview Standard

• Introduction to Threat Investigation with the Unified Audit Log (UAL)
• Explore Microsoft Purview Audit Solutions
• Implement Microsoft Purview Audit (Standard)
• Start Recording Activity in the Unified Audit Log
• Search the Unified Audit Log (UAL)
• Export, Configure, and View Audit Log Records
• Use Audit Log Searching to Investigate Common Support Issues

Module 10: Investigate Threats Using Audit in Microsoft 365 Defender and Microsoft Purview (Premium)

• Introduction to Threat Investigation with the Unified Audit Log (UAL)
• Explore Microsoft Purview Audit Solutions
• Implement Microsoft Purview Audit (Standard)
• Start Recording Activity in the Unified Audit Log
• Search the Unified Audit Log (UAL)
• Export, Configure, and View Audit Log Records
• Use Audit Log Searching to Investigate Common Support Issues

Module 11: Investigate Threats with Content Search in Microsoft Purview

• Introduction
• Explore Microsoft Purview eDiscovery Solutions
• Create a Content Search
• View the Search Results and Statistics
• Export the Search Results and Search Report
• Configure Search Permissions Filtering
• Search for and Delete Email Messages

Module 12: Protect Against Threats with Microsoft Defender for Endpoint

• Introduction to Microsoft Defender for Endpoint
• Practice Security Administration
• Hunt Threats within Your Network

Module 13: Deploy the Microsoft Defender for Endpoint Environment

• Introduction
• Create Your Environment
• Understand Operating Systems Compatibility and Features
• Onboard Devices
• Manage Access
• Create and Manage Roles for Role-Based Access Control
• Configure Device Groups
• Configure Environment Advanced Features

Module 14: Implement Windows Security Enhancements with Microsoft Defender for Endpoint

• Introduction
• Understand Attack Surface Reduction
• Enable Attack Surface Reduction Rules

Module 15: Perform Device Investigations in Microsoft Defender for Endpoint

• Introduction
• Use the Device Inventory List
• Investigate the Device
• Use Behavioral Blocking
• Detect Devices with Device Discovery

Module 16: Perform Actions on a Device Using Microsoft Defender for Endpoint

• Introduction
• Explain Device Actions
• Run Microsoft Defender Antivirus Scan on Devices
• Collect Investigation Package from Devices
• Initiate Live Response Session

Module 17: Perform Evidence and Entities Investigations Using Microsoft Defender for Endpoint

• Introduction
• Investigate a File
• Investigate a User Account
• Investigate an IP Address
• Investigate a Domain

Module 18: Configure and Manage Automation Using Microsoft Defender for Endpoint

• Introduction
• Configure Advanced Features
• Manage Automation Upload and Folder Settings
• Configure Automated Investigation and Remediation Capabilities
• Block At-Risk Devices

Module 19: Configure for Alerts and Detections in Microsoft Defender for Endpoint

• Introduction
• Configure Advanced Features
• Configure Alert Notifications
• Manage Alert Suppression
• Manage Indicators

Module 20: Utilise Vulnerability Management in Microsoft Defender for Endpoint

• Introduction
• Understand Vulnerability Management
• Explore Vulnerabilities on Your Devices
• Manage Remediation

Module 21: Plan for Cloud Workload Protections Using Microsoft Defender for Cloud

• Introduction
• Explain Microsoft Defender for Cloud
• Describe Microsoft Defender for Cloud Workload Protections
• Exercise – Microsoft Defender for Cloud Interactive Guide
• Enable Microsoft Defender for Cloud

Module 22: Connect Azure Assets to Microsoft Defender for Cloud

• Introduction
• Explore and Manage Your Resources with Asset Inventory
• Configure Auto Provisioning
• Manual Log Analytics Agent Provisioning

Module 23: Connect Non-Azure Resources to Microsoft Defender for Cloud

• Introduction
• Protect Non-Azure Resources
• Connect Non-Azure Machines
• Connect Your AWS Accounts
• Connect Your GCP Accounts

Module 24: Manage Your Cloud Security Posture Management

• Introduction
• Explore Secure Score
• Explore Recommendations
• Measure and Enforce Regulatory Compliance
• Understand Workbooks

Module 25: Explain Cloud Workload Protections in Microsoft Defender for Cloud

• Introduction
• Understand Microsoft Defender for Servers
• Understand Microsoft Defender for App Service
• Understand Microsoft Defender for Storage
• Understand Microsoft Defender for SQL
• Understand Microsoft Defender for Open-Source Databases
• Understand Microsoft Defender for Key Vault
• Understand Microsoft Defender for Resource Manager
• Understand Microsoft Defender for DNS
• Understand Microsoft Defender for Containers
• Understand Microsoft Defender Additional Protections

Module 26: Remediate Security Alerts Using Microsoft Defender for Cloud

• Introduction
• Understand Security Alerts
• Remediate Alerts and Automate Responses
• Suppress Alerts from Defender for Cloud
• Generate Threat Intelligence Reports
• Respond to Alerts from Azure Resources

Module 27: Construct KQL Statements for Microsoft Sentinel

• Introduction
• Understand the Kusto Query Language Statement Structure
• Use the Search Operator
• Use the Where Operator
• Use the Let Statement
• Use the Extend Operator
• Use the Order By Operator
• Use the Project Operators

Module 28: Analyse Query Results Using KQL

• Introduction
• Use the Summarise Operator
• Use the Summarise Operator to Filter Results
• Use the Summarise Operator to Prepare Data
• Use the Render Operator to Create Visualisations

Module 29: Build Multi-Table Statements Using KQL

• Introduction
• Use the Union Operator
• Use the Join Operator

Module 30: Work with Data in Microsoft Sentinel Using Kusto Query Language

• Introduction
• Extract Data from Unstructured String Fields
• Extract Data from Structured String Data
• Integrate External Data
• Create Parsers with Functions

Module 31: Introduction to Microsoft Sentinel

• Introduction
• What is Microsoft Sentinel?
• How Microsoft Sentinel Works?
• When to Use Microsoft Sentinel?

Module 32: Create and Manage Microsoft Sentinel Workspaces

• Introduction
• Plan for the Microsoft Sentinel Workspace
• Create a Microsoft Sentinel Workspace
• Manage Workspaces Across Tenants Using Azure Lighthouse
• Understand Microsoft Sentinel Permissions and Roles
• Manage Microsoft Sentinel Settings
• Configure Logs

Module 33: Query Logs in Microsoft Sentinel

• Introduction
• Query Logs in the Logs Page
• Understand Microsoft Sentinel Tables
• Understand Common Tables
• Understand Microsoft 365 Defender Tables

Module 34: Use Watchlists in Microsoft Sentinel

• Introduction
• Plan for Watchlists
• Create a Watchlist
• Manage Watchlists

Module 35: Utilise Threat Intelligence in Microsoft Sentinel

• Introduction
• Define Threat Intelligence
• Manage Your Threat Indicators
• View Your Threat Indicators with KQL

Module 36: Connect Data to Microsoft Sentinel Using Data Connectors

• Introduction
• Ingest Log Data with Data Connectors
• Understand Data Connector Providers
• View Connected Hosts

Module 37: Connect Microsoft Services to Microsoft Sentinel

• Introduction
• Plan for Microsoft Services Connectors
• Connect the Microsoft Office 365 Connector
• Connect the Azure Active Directory Connector
• Connect the Azure Active Directory Identity Protection Connector
• Connect the Azure Activity Connector

Module 38: Connect Microsoft 365 Defender to Microsoft Sentinel

• Introduction
• Plan for Microsoft 365 Defender Connectors
• Connect the Microsoft 365 Defender Connector
• Connect Microsoft Defender for Cloud Connector
• Connect Microsoft Defender for IoT
• Connect Microsoft Defender Legacy Connectors

Module 39: Connect Windows Hosts to Microsoft Sentinel

• Introduction
• Plan for Windows Hosts Security Events Connector
• Connect Using the Windows Security Events via AMA Connector
• Connect Using the Security Events via Legacy Agent Connector
• Collect Sysmon Event Logs

Module 40: Connect Common Event Format Logs to Microsoft Sentinel

• Introduction
• Plan for Common Event Format Connector
• Connect Your External Solution Using the Common Event Format Connector

Module 41: Connect Syslog Data Sources to Microsoft Sentinel

• Introduction
• Plan for Syslog Data Collection
• Collect Data from Linux-Based Sources Using Syslog
• Configure the Data Collection Rule for Syslog Data Sources
• Parse Syslog Data with KQL

Module 42: Connect Threat Indicators to Microsoft Sentinel

• Introduction
• Plan for Threat Intelligence Connectors
• Connect the Threat Intelligence TAXII Connector
• Connect the Threat Intelligence Platforms Connector
• View Your Threat Indicators with KQL

Module 43: Threat Detection with Microsoft Sentinel Analytics

• Introduction
• Exercise - Detect Threats with Microsoft Sentinel Analytics
• What is Microsoft Sentinel Analytics?
• Types of Analytics Rules
• Create an Analytics Rule from Templates
• Create an Analytics Rule from Wizard
• Manage Analytics Rules
• Exercise - Detect Threats with Microsoft Sentinel Analytics

Module 44: Automation in Microsoft Sentinel

• Introduction
• Understand Automation Options
• Create Automation Rules

Module 45: Security Incident Management in Microsoft Sentinel

• Introduction
• Exercise - Set Up the Azure Environment
• Understand Incidents
• Incident Evidence and Entities
• Incident Management
• Exercise - Investigate an Incident

Module 46: Identify Threats with Behavioral Analytics

• Introduction
• Understand Behavioral Analytics
• Explore Entities
• Display Entity Behavior Information
• Use Anomaly Detection Analytical Rule Templates

Module 47: Data Normalisation in Microsoft Sentinel

• Introduction
• Understand Data Normalisation
• Use ASIM Parsers
• Understand Parameterised KQL Functions
• Create an ASIM Parser
• Configure Azure Monitor Data Collection Rules

Module 48: Query, Visualise, and Monitor Data in Microsoft Sentinel

• Introduction
• Exercise - Query and Visualise Data with Microsoft Sentinel Workbooks
• Monitor and Visualise Data
• Query Data Using Kusto Query Language
• Use Default Microsoft Sentinel Workbooks
• Create a New Microsoft Sentinel Workbook
• Exercise - Visualise Data Using Microsoft Sentinel Workbooks

Module 49: Manage Content in Microsoft Sentinel

• Introduction
• Use Solutions from the Content Hub
• Use Repositories for Deployment

Module 50: Explain Threat Hunting Concepts in Microsoft Sentinel

• Introduction
• Understand Cybersecurity Threat Hunts
• Develop a Hypothesis
• Explore MITRE ATT and CK

Module 51: Threat Hunting with Microsoft Sentinel

• Introduction
• Exercise Setup
• Explore Creation and Management of Threat-Hunting Queries
• Save Key Findings with Bookmarks
• Observe Threats Over Time with Livestream
• Exercise - Hunt for Threats by Using Microsoft Sentinel

Module 52: Use Search Jobs in Microsoft Sentinel

• Introduction
• Hunt with a Search Job
• Restore Historical Data

Module 53: Hunt for Threats Using Notebooks in Microsoft Sentinel

• Introduction
• Access Azure Sentinel Data with External Tools
• Hunt with Notebooks
• Create a Notebook
• Explore Notebook Code

Microsoft Identity and Access Administrator SC300 Course Outline

Module 1: Explore Identity and Azure AD

• Introduction
• Explain the Identity Landscape
• Explore Zero Trust with Identity
• Discuss Identity as a Control Plane
• Explore Why We Have Identity
• Define Identity Administration
• Contrast Decentralised Identity with Central Identity Systems
• Discuss Identity Management Solutions
• Explain Azure AD Business to Business
• Compare Microsoft Identity Providers
• Define Identity Licensing
• Explore Authentication
• Discuss Authorisation
• Explain Auditing in Identity

Module 2: Implement Initial Configuration of Azure Active Directory

• Introduction
• Configure Company Brand
• Configure and Manage Azure Active Directory Roles
• Exercise: Manage Users Roles
• Configure Delegation by Using Administrative Units
• Analyse Azure AD Role Permissions
• Configure and Manage Custom Domains
• Configure Tenant-Wide Settings
• Exercise: Setting Tenant-Wide Properties

Module 3: Create, Configure, and Manage Identities

• Introduction
• Create, Configure, and Manage Users
• Exercise: Assign Licenses to Users
• Exercise: Restore or Remove Deleted Users
• Create, Configure, and Manage Groups
• Exercise: Add Groups in Azure Active Directory
• Configure and Manage Device Registration
• Manage Licenses
• Exercise: Change Group License Assignments
• Exercise: Change User License Assignments
• Create Custom Security Attributes
• Explore Automatic User Creation

Module 4: Implement and Manage External Identities

• Introduction
• Describe Guest Access and Business to Business Accounts
• Manage External Collaboration
• Exercise: Configure External Collaboration
• Invite External Users - Individually and in Bulk
• Exercise: Add Guest Users to Directory
• Exercise: Invite Guest Users in Bulk
• Demo: Manage Guest Users in Azure Active Directory
• Manage External User Accounts in Azure Active Directory
• Manage External Users in Microsoft 365 Workloads
• Exercise: Explore Dynamic Groups
• Implement Cross-Tenant Access Controls
• Configure Identity Providers
• Implement and Manage Entra Verified ID

Module 5: Implement and Manage Hybrid Identity

• Introduction
• Plan, Design, and Implement Azure Active Directory Connect
• Implement Manage Password Hash Synchronisation (PHS)
• Implement Manage Pass-Through Authentication (PTA)
• Demo: Manage Pass-Through Authentication and Seamless Single Sign-On (SSO)
• Implement and Manage Federation
• Troubleshoot Synchronisation Errors
• Implement Azure Active Directory Connect Health
• Manage Azure Active Directory Connect Health

Module 6: Secure Azure Active Directory Users with Multi-Factor Authentication

• Introduction
• What Is Azure AD Multi-Factor Authentication?
• Plan Your Multi-Factor Authentication Deployment
• Exercise: Enable Azure AD Multi-Factor Authentication
• Configure Multi-Factor Authentication Methods

Module 7: Manage User Authentication

• Introduction
• Administer FIDO2 and Passwordless Authentication Methods
• Explore Authenticator App and OATH Tokens
• Implement an Authentication Solution Based on Windows Hello for Business
• Exercise: Configure and Deploy Self-Service Password Reset
• Deploy and Manage Password Protection
• Configure Smart Lockout Thresholds
• Exercise: Manage Azure Active Directory Smart Lockout Values
• Implement Kerberos and Certificate-Based Authentication in Azure AD
• Configure Azure AD User Authentication for Virtual Machines

Module 8: Plan, Implement, and Administer Conditional Access

• Introduction
• Plan Security Defaults
• Exercise: Work with Security Defaults
• Plan Conditional Access Policies
• Implement Conditional Access Policy Controls and Assignments
• Exercise: Implement Conditional Access Policies Roles and Assignments
• Test and Troubleshoot Conditional Access Policies
• Implement Application Controls
• Implement Session Management
• Exercise: Configure Authentication Session Controls
• Implement Continuous Access Evaluation

Module 9: Manage Azure AD Identity Protection

• Introduction
• Review Identity Protection Basics
• Implement and Manage User Risk Policy
• Exercise: Enable Sign-In Risk Policy
• Exercise: Configure Azure Active Directory Multi-Factor Authentication Registration Policy
• Monitor, Investigate, and Remediate Elevated Risky Users
• Implement Security for Workload Identities
• Explore Microsoft Defender for Identity

Module 10: Implement Access Management for Azure Resources

• Introduction
• Assign Azure Roles
• Configure Custom Azure Roles
• Create and Configure Managed Identities
• Access Azure Resources with Managed Identities
• Analyse Azure Role Permissions
• Configure Azure Key Vault RBAC Policies
• Retrieve Objects from Azure Key Vault
• Explore Entra Permissions Management (CloudKnox)

Module 11: Plan and Design the Integration of Enterprise Apps for SSO

• Introduction
• Discover Apps by Using Microsoft Defender for Cloud Apps and Active Directory Federation Services App Report
• Configure Connectors to Apps
• Exercise: Implement Access Management for Apps
• Design and Implement App Management Roles
• Exercise: Create a Custom Role to Manage App Registration
• Configure Pre-Integrated Gallery SaaS Apps
• Implement and Manage Policies for OAuth Apps

Module 12: Implement and Monitor the Integration of Enterprise Apps for SSO

• Introduction
• Implement Token Customisations
• Implement and Configure Consent Settings
• Integrate On-Premises Apps by Using Azure Active Directory Application Proxy
• Integrate Custom SaaS Apps for Single Sign-On
• Implement Application User Provisioning
• Monitor and Audit Access to Azure Active Directory Integrated Applications
• Create and Manage Application Collections

Module 13: Implement App Registration

• Introduction
• Plan Your Line of Business Application Registration Strategy
• Implement Application Registration
• Exercise: Register an Application
• Configure Application Permission
• Exercise: Grant Tenant-Wide Admin Consent to an Application
• Implement Application Authorisation
• Exercise: Add App Roles to Application and Receive Tokens
• Manage and Monitor Applications with App Governance

Module 14: Plan and Implement Entitlement Management

• Introduction
• Define Access Packages
• Exercise: Create and Manage a Resource Catalog with Azure AD Entitlement
• Configure Entitlement Management
• Exercise: Add Terms of Use Acceptance Report
• Exercise: Manage the Lifecycle of External Users with Azure AD Identity Governance
• Configure and Manage Connected Organisations
• Review Per-User Entitlements

Module 15: Plan, Implement, and Manage Access Review

• Introduction
• Plan for Access Reviews
• Create Access Reviews for Groups and Apps
• Create and Configure Access Review Programs
• Monitor Access Review Findings
• Automate Access Review Management Tasks
• Configure Recurring Access Reviews

Module 16: Plan and Implement Privileged Access

• Introduction
• Define a Privileged Access Strategy for Administrative Users
• Configure Privileged Identity Management for Azure Resources
• Exercise: Configure Privileged Identity Management for Azure Active Directory Roles
• Exercise: Assign Azure Active Directory Roles in Privileged Identity Management
• Exercise: Assign Azure Resource Roles in Privileged Identity Management
• Plan and Configure Privileged Access Groups
• Analyse Privileged Identity Management Audit History and Reports
• Create and Manage Emergency Access Accounts

Module 17: Monitor and Maintain Azure Active Directory

• Introduction
• Analyse and Investigate Sign-In Logs to Troubleshoot Access Issues
• Review and Monitor Azure Active Directory Audit Logs
• Exercise: Connect Data from Azure Active Directory to Microsoft Sentinel
• Export Logs to Third-Party Security Information and Event Management System
• Analyse Azure Active Directory Workbooks and Reporting
• Monitor Security Posture with Identity Secure Score

Microsoft Information Protection Administrator SC400​ Course Outline

Module 1: Introduction to Information Protection and Data Lifecycle Management in Microsoft Purview

• Introduction to Information Protection and Data Lifecycle Management
• Know Your Data
• Protect Your Data
• Prevent Data Loss
• Govern Your Data

Module 2: Classify Data for Protection and Governance

• Data Classification Overview
• Classify Data Using Sensitive Information Types
• Classify Data Using Trainable Classifiers
• Review Sensitive Information and Label Usage
• Explore Labelled and Sensitive Content
• Understand Activities Related to Your Data

Module 3: Create and Manage Sensitive Information Types

• Introduction
• Compare Built-In Versus Custom Sensitive Information Types
• Create and Manage Custom Sensitive Information Types
• Describe Custom Sensitive Information Types with Exact Data Match
• Implement Document Fingerprinting
• Create Keyword Dictionary

Module 4: Understand Microsoft 365 Encryption

• Introduction to Microsoft 365 Encryption
• Learn How Microsoft 365 Data Is Encrypted at Rest
• Understand Service Encryption in Microsoft Purview
• Explore Customer Key Management Using Customer Key
• Learn How Data Is Encrypted In-Transit

Module 5: Deploy Microsoft Purview Message Encryption

• Introduction to Microsoft 365 Encryption
• Learn How Microsoft 365 Data Is Encrypted at Rest
• Understand Service Encryption in Microsoft Purview
• Explore Customer Key Management Using Customer Key
• Learn How Data Is Encrypted In-Transit

Module 6: Protect Information in Microsoft Purview

• Information Protection Overview
• Configure Sensitivity Labels
• Configure Sensitivity Label Policies
• Configure Auto-Labelling Policies
• Manage, Monitor, and Remediate Information Protection

Module 7: Apply and Manage Sensitivity Labels

• Introduction
• Apply Sensitivity Labels to Microsoft Teams, Microsoft 365 Groups, and SharePoint Sites
• Plan On-Premises Labelling
• Configure On-Premises Labelling for the Unified Labelling Scanner
• Apply Protections and Restrictions to Email and Files
• Monitor Label Performance Using Label Analytics

Module 8: Prevent Data Loss in Microsoft Purview

• Introduction
• Data Loss Prevention Overview
• Identify Content to Protect
• Define Policy Settings for Your DLP Policy
• Test and Create Your DLP Policy
• Prepare Endpoint DLP
• Manage DLP Alerts in the Microsoft Purview Compliance Portal
• View Data Loss Prevention Reports
• Implement the Microsoft Purview Extension

Module 9: Configure DLP Policies for Microsoft Defender for Cloud Apps and Power Platform

• Introduction
• Configure Data Loss Prevention Policies for Power Platform
• Integrate Data Loss Prevention in Microsoft Defender for Cloud Apps
• Configure Policies in Microsoft Defender for Cloud Apps
• Manage Data Loss Prevention Violations in Microsoft Defender for Cloud Apps

Module 10: Manage Data Loss Prevention Policies and Reports in Microsoft 365

• Introduction
• Configure Data Loss Prevention for Policy Precedence
• Implement Data Loss Prevention Policies in Test Mode
• Explain Data Loss Prevention Reporting Capabilities
• Manage Permissions for Data Loss Prevention Reports
• Manage and Respond to Data Loss Prevention Policy Violations

Module 11: Manage the Data Lifecycle in Microsoft Purview

• Data Lifecycle Management Overview
• Configure Retention Policies
• Configure Retention Labels
• Configure Manual Retention Label Policies
• Configure Auto-Apply Retention Label Policies
• Import Data for Data Lifecycle Management
• Manage, Monitor, and Remediate Data Lifecycle Management

Module 12: Manage Data Retention in Microsoft 365 Workloads

• Introduction
• Explain Retention in Exchange Online
• Explain Retention in SharePoint Online and OneDrive
• Explain Retention in Microsoft Teams
• Explain Retention in Microsoft Yammer
• Recover Content in Microsoft 365 Workloads
• Activate Archive Mailboxes in Microsoft Exchange
• Apply Mailbox Holds in Microsoft Exchange
• Recover Content in Microsoft Exchange

Module 13: Manage Records in Microsoft Purview

• Introduction
• Records Management Overview
• Import a File Plan
• Configure Retention Labels
• Configure Event-Driven Retention
• Manage, Monitor, and Remediate Records

Module 14: Explore Compliance in Microsoft 365

• Introduction
• Plan for Security and Compliance in Microsoft 365
• Plan Your Beginning Compliance Tasks in Microsoft Purview
• Manage Your Compliance Requirements with Compliance Manager
• Examine the Compliance Manager Dashboard
• Analyse the Microsoft Compliance Score

Module 15: Search for Content in the Microsoft Purview Compliance Portal

• Introduction
• Explore Microsoft Purview eDiscovery Solutions
• Create a Content Search
• View the Search Results and Statistics
• Export the Search Results and Search Report
• Configure Search Permissions Filtering
• Search for and Delete Email Messages

Module 16: Manage Microsoft Purview eDiscovery (Standard)

• Introduction
• Explore Microsoft Purview eDiscovery Solutions
• Implement Microsoft Purview eDiscovery (Standard)
• Create eDiscovery Holds
• Search for Content in a Case
• Export Content from a Case
• Close, Reopen, and Delete a Case

Module 17: Manage Microsoft Purview eDiscovery (Premium)

• Introduction
• Explore Microsoft Purview eDiscovery (Premium)
• Implement Microsoft Purview eDiscovery (Premium)
• Create and Manage an eDiscovery (Premium) Case
• Manage Custodians and Non-Custodial Data Sources
• Analyse Case Content

Module 18: Manage Microsoft Purview Audit (Standard)

• Introduction
• Explore Microsoft Purview Audit Solutions
• Implement Microsoft Purview Audit (Standard)
• Search the Audit Log
• Export, Configure, and View Audit Log Records
• Use Audit Log Searching to Investigate Common Support Issues

Module 19: Prepare Microsoft Purview Communication Compliance

• Introduction to Communication Compliance
• Plan for Communication Compliance
• Identify and Resolve Communication Compliance Workflow
• Introduction to Communication Compliance Policies
• Knowledge Check
• Case Study: Configure an Offensive Language Policy
• Investigate and Remediate Communication Compliance Alerts

Module 20: Manage Insider Risk in Microsoft Purview

• Insider Risk Management Overview
• Introduction to Managing Insider Risk Policies
• Create and Manage Insider Risk Policies
• Knowledge Check
• Investigate Insider Risk Alerts
• Take Action on Insider Risk Alerts Through Cases
• Manage Insider Risk Management Forensic Evidence
• Create Insider Risk Management Notice Templates

Module 21: Implement Microsoft Purview Information Barriers

• Introduction
• Explore Microsoft Purview Information Barriers
• Configure Information Barriers in Microsoft Purview
• Examine Information Barriers in Microsoft Teams
• Examine Information Barriers in OneDrive
• Examine Information Barriers in SharePoint

Module 22: Manage Regulatory and Privacy Requirements with Microsoft Priva

• Introduction
• Create and Manage Risk Management Policies
• Investigate and Remediate Risk Management Alerts
• Create Rights Requests
• Manage Data Estimate and Retrieval for Rights Requests
• Review Data from Rights Requests
• Get Reports from Rights Requests

Module 23: Implement Privileged Access Management

• Introduction to Privileged Access Management
• Case Study: Implementing Privileged Access Management
• Introduction to Customer Lockbox
• Manage Customer Lockbox Requests

Microsoft Security, Compliance, and Identity Fundamentals SC900 Course Outline

Module 1: Security and Compliance Concepts

• Introduction
• Describe the Shared Responsibility Model
• Describe Defense in Depth
• Describe the Zero Trust Model
• Describe Encryption and Hashing
• Describe Governance, Risk, and Compliance (GRC) Concepts

Module 2: Identity Concepts

• Introduction
• Define Authentication and Authorisation
• Define Identity as the Primary Security Perimeter
• Describe the Role of the Identity Provider
• Describe the Concept of Directory Services and Active Directory
• Describe the Concept of Federation

Module 3: The Function and Identity Types of Microsoft Entra ID

• Introduction
• Describe Microsoft Entra ID
• Describe Types of Identities
• Describe Hybrid Identity
• Describe External Identities

Module 4: Authentication Capabilities of Microsoft Entra ID

• Introduction
• Describe Authentication Methods
• Describe Multifactor Authentication
• Describe Self-Service Password Reset
• Describe Password Protection and Management Capabilities

Module 5: Access Management Capabilities of Microsoft Entra ID

• Introduction
• Describe Conditional Access
• Describe Microsoft Entra Roles and Role-Based Access Control (RBAC)

Module 6: Identity Protection and Governance Capabilities of Microsoft Entra

• Introduction
• Describe Microsoft Entra ID Governance
• Describe Access Reviews
• Describe Entitlement Management
• Describe the Capabilities of Privileged Identity Management
• Describe Microsoft Entra ID Protection
• Describe Microsoft Entra Permissions Management
• Describe Microsoft Entra Verified ID

Module 7: Core Infrastructure Security Services in Azure

• Introduction
• Describe Azure DDoS Protection
• Describe Azure Firewall
• Describe Web Application Firewall
• Describe Network Segmentation in Azure
• Describe Azure Network Security Groups
• Describe Azure Bastion
• Describe Azure Key Vault

Module 8: Security Management Capabilities of Azure

• Introduction
• Describe Microsoft Defender for Cloud
• Describe How Security Policies and Initiatives Improve Cloud Security Posture
• Describe Cloud Security Posture Management
• Describe the Enhanced Security of Microsoft Defender for Cloud
• Describe DevOps Security Management

Module 9: Security Capabilities of Microsoft Sentinel

• Introduction
• Define the Concepts of SIEM and SOAR
• Describe Threat Detection and Mitigation Capabilities in Microsoft Sentinel
• Describe Microsoft Security Copilot

Module 10: Threat Protection with Microsoft 365 Defender

• Introduction
• Describe Microsoft 365 Defender Services
• Describe Microsoft Defender for Office 365
• Describe Microsoft Defender for Endpoint
• Describe Microsoft Defender for Cloud Apps
• Describe Microsoft Defender for Identity
• Describe Microsoft Defender Vulnerability Management
• Describe Microsoft Defender Threat Intelligence
• Describe the Microsoft 365 Defender Portal

Module 11: Microsoft’s Service Trust Portal and Privacy Capabilities

• Introduction
• Describe the Offerings of the Service Trust Portal
• Describe Microsoft's Privacy Principles
• Describe Microsoft Privacy

Module 12: Compliance Management Capabilities in Microsoft Purview

• Introduction
• Describe the Microsoft Purview Compliance Portal
• Describe Compliance Manager
• Describe Use and Benefits of Compliance Score

Module 13: Information Protection and Data Lifecycle Management in Microsoft Purview

• Introduction
• Know Your Data, Protect Your Data, and Govern Your Data
• Describe the Data Classification Capabilities of the Compliance Portal
• Describe Sensitivity Labels and Policies
• Describe Data Loss Prevention
• Describe Retention Policies and Retention Labels
• Describe Records Management

Module 14: Insider Risk Capabilities in Microsoft Purview

• Introduction
• Describe Insider Risk Management
• Describe Communication Compliance
• Describe Information Barriers

Module 15: Discovery and Audit Capabilities of Microsoft Purview

• Introduction
• Describe the eDiscovery Solutions in Microsoft Purview
• Describe the Audit Solutions in Microsoft Purview

Module 16: Resource Governance Capabilities in Azure

• Introduction
• Describe Azure Policy
• Describe the Use of Azure Blueprints
• Describe the Capabilities in the Microsoft Purview Governance Portal

Microsoft Security Workshop: Implementing PowerShell Security Best Practices 40555A Training Course Outline

Module 1: PowerShell Fundamentals

• Overview of Windows PowerShell
• PowerShell Editions and Versions
• Running PowerShell

Module 2: PowerShell Operational Security

• Managing Local Script Execution
• Managing Remote Execution Capabilities of Windows PowerShell
• Managing Remote Execution Capabilities of PowerShell Core
• Language Mode

Module 3: Implementing PowerShell-based Security

• Windows PowerShell DSC
• Just Enough Administration (JEA)
• Windows PowerShell Auditing and Logging

Module 4: Windows PowerShell-based Exploits and their Mitigation

• Windows PowerShell-Based Attacks
• Windows PowerShell-Based Security Tools
• Summary of Windows PowerShell Security-Related Technologies

Lab: Implementing Windows PowerShell Security

• Implement Windows PowerShell Logging by Using DSC
• Carry Out a Windows PowerShell-Based Exploit
• Implement Just Enough Administration