Courses

Short courses that teach one job well

One to two hours each, built around a working lab, and recorded in today's portals. Finish in an evening, use it at work the next day.

Short courses

In production

Released one at a time, roughly every three weeks.

SENTINELIN PRACTICE
Launching Nov 2026

Microsoft Sentinel in Practice

Set up Sentinel in the Defender portal, detect and investigate real incidents, then automate the response, all the way to ServiceNow tickets.

  • 2 hours · 14 lectures
  • Recorded in the Defender portal
  • Playbook templates included
ENTRA IDCONDITIONAL ACCESS
Coming next

Entra ID & Conditional Access Essentials

Build a secure identity baseline: MFA, Conditional Access, break-glass accounts and risky sign-in policies, in a live tenant.

  • About 90 minutes
  • Hands-on in a real tenant
  • Policy naming and rollout plan
AZUREPOLICY & GOVERNANCE
Planned

Azure Policy & Governance in Practice

Tagging, built-in and custom policies, remediation and management groups: the guardrails that keep Azure tidy and costs under control.

  • About 90 minutes
  • Ready-to-use policy set
  • Ties into cost control
First course

Inside Microsoft Sentinel in Practice

Five sections, 14 lectures, about two hours. It ends with the build most courses skip: incidents that open ServiceNow tickets on their own.

1

Foundations

20 min
  • What a SIEM does and where Sentinel fits
  • Sentinel in the Defender portal: what moved
  • What Sentinel costs, and how to keep a lab cheap
2

Set up and connect data

30 min
  • Workspace and Sentinel onboarding
  • Data connectors: Entra ID, Azure Activity, Defender for Cloud
  • Just enough KQL: six queries every analyst uses
3

Detect and investigate

30 min
  • Analytics rules from templates and from scratch
  • Trigger a real incident
  • Investigate with entities, timeline and hunting
4

Automate the response

35 min
  • Automation rules vs playbooks
  • Playbook: enrich and notify Teams
  • Playbook: create a ServiceNow incident automatically
  • De-duplication and severity mapping
5

Wrap-up

5 min
  • Production checklist and next steps

Join the waitlist

Coming later

On the roadmap

Longer courses and exam paths, after the short courses are out.

Later

SC-300 + SC-900 complete course

Full exam path with all 28 official labs and practice tests.

Later

Azure Private Endpoints & Private DNS

Private Link, DNS zones, hub-and-spoke and hybrid name resolution.

Later

Terraform on Azure

Build a landing zone as code, step by step.

Later

AZ-104 Azure Administrator

Exam-aligned admin course with labs.

Want a course on something else?

Tell me what you're stuck on in Azure. The most-requested topics get made next.

Suggest a topic