Skip to content
UdemyHackingPaid courseAll LevelsCertificate

Microsoft Defender Course with hands on training and sims (Udemy.com)

Learn how to expertly administer Microsoft Defender XDR (formerly Microsoft 365 Defender) with hands on experience!

Created by: John Christopher

Last updated October 2026

icon
What you will learn

  • Learn the concepts and perform hands on activities needed to master Microsoft Defender XDR (formerly Microsoft 365 Defender)
  • Gain a tremendous amount of knowledge involving Microsoft Defender XDR (formerly Microsoft 365 Defender)
  • Learn using hands on simulations on how Microsoft Defender XDR (formerly Microsoft 365 Defender) is administered!
  • Learn how to set up your own test lab for practicing the concepts!

How it compares

Against the other 523 rated Udemy courses in Hacking on CourseDuck:

  • Rating4.6 out of 5higher than 72% of them
  • Reviews1,863#121 of 524 by number of reviews
  • Length9.5 hourslonger than 69% of them
  • Last updatedOctober 2026more recently than 99% of them

icon
Course Description

We really hope you'll agree, this training is way more than the average course on Udemy!

Have access to the following:

  • Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified Trainer

  • Lecture that explains the concepts in an easy to learn method for someone that is just starting out with this material

  • Instructor led hands on and simulations to practice that can be followed even if you have little to no experience

TOPICS COVERED INCLUDING HANDS ON LECTURE AND PRACTICE TUTORIALS:

Introduction

  • Welcome to the course

  • Understanding the Microsoft Environment

  • Foundations of Active Directory Domains

  • Foundations of RAS, DMZ, and Virtualization

  • Foundations of the Microsoft Cloud Services

  • DONT SKIP: The first thing to know about Microsoft cloud services

  • DONT SKIP: Azure AD is now renamed to Entra ID

  • Questions for John Christopher

Performing hands on activities

  • DONT SKIP: Using Assignments in the course

  • Creating a free Microsoft 365 Account

  • Activating licenses for Defender for Endpoint and Vulnerabilities

  • Getting your free Azure credit

Basic concepts of the Microsoft Defender Suite and Services

  • The Microsoft 365 Defender Suite

  • Using the Defender and Purview admin centers

Microsoft Defender for Office 365

  • What is Microsoft Defender for Office 365?

  • Implementing policies for uses in Email, SharePoint, OneDrive, and Teams

  • Dealing with threats using Defender for Office 365

  • Performing a campaign email attack simulation in Microsoft Defender

Microsoft Defender for Cloud Apps and Data Loss Prevention (DLP)

  • Understanding the concepts of Microsoft Defender for Cloud Apps

  • Investigating security risks in Defender for Cloud Apps

  • Concepts of data loss prevention in Microsoft Defender

  • Alerts with data loss prevention policies (DLP)

  • Data loss prevention (DLP) policy alert investigation

Microsoft Defender for Endpoint and Defender Vulnerability Management

  • Understanding Microsoft Defender for Endpoint concepts

  • Deploy a Windows 11 VM endpoint

  • Attack surface reduction (ASR) support with Intune

  • Working with device onboarding regarding Defender for Endpoint

  • Something to be aware of about extra features

  • Endpoint advanced features, alerts and incidents

  • Endpoint vulnerabilities

  • Device attack surface reduction (ASR)

  • Device groups with Defender for Endpoint

  • Microsoft Defender Vulnerability Management risk identification

  • Endpoint threat indicators

  • Device discovery of unmanaged devices

Microsoft Identity Concepts

  • Microsoft Entra ID security risk mitigation

  • Concepts of using Microsoft Entra Identity Protection

  • Microsoft Entra Identity Protection security risk mitigation

  • Microsoft Entra Identity Protection risks in regards to Microsoft Defender

  • Microsoft Defender for Identity concepts

  • Using Defender for Identity to mitigate threats with AD DS

Microsoft 365 Defender as an Extended Detection and Response (XDR)

  • Visualizing the concepts of extended detection and responses (XDR)

  • Configuring the Microsoft 365 Defender simulation lab

  • Performing an attack using the simulation lab

  • Microsoft 365 Defender incidents and automated investigations

  • Microsoft 365 Defender action and submissions

  • Using Kusto Query Language (KQL) for threat identification

  • Microsoft Secure Score

  • Microsoft 365 Defender threat analytics

  • Custom detections and alerts

Getting started w/ Defender for Cloud, Defender for Servers & Defender for DevOps

  • Introduction to Microsoft Defender for Cloud

  • Regulatory compliance policies along with MCSB

  • Remediation's with secure score in Microsoft Defender for Cloud

  • Microsoft Defender for Servers

  • Microsoft Defender for DevOps

  • Microsoft Defender External Attack Surface Management (EASM)

Microsoft Defender for Cloud full management and configurations

  • Settings config in Microsoft Defender for Cloud

  • Roles in Microsoft Defender for Cloud

  • Cloud workload protection

  • Automation of onboarding Azure resource

  • Azure Arc connections

  • Multi-cloud connections

  • Email notifications in Microsoft Defender for Cloud

  • Using alert suppression rules

  • Workflow automation configuration in Defender for Cloud

  • Using sample alerts and incidents

  • Using Microsoft Defender for Cloud recommendations

  • Security alerts and incidents in Microsoft Defender for Cloud

  • Using threat intelligence reports with Microsoft Defender for Cloud

Dealing with insider risks in Microsoft 365

  • Concepts of insider risk policies

  • Insider risk policy generation

  • Insider risk policy alert investigation

Audit and search capabilities in Microsoft Defender and Microsoft Purview

  • Licensing of unified audit logging

  • Permissions for unified auditing

  • Threat hunting with unified audit logging

  • Threat hunting with Content Searches

Conclusion

  • Cleaning up your lab environment

  • Getting a Udemy certificate

  • BONUS Where do I go from here?

icon
Udemy Discount

The discount is applied through our link. Open the course from here and Udemy's current promotional price is applied at checkout on most courses, no code to type.

Some courses are excluded from Udemy's promotions. If the price does not drop, clear your browser cookies and use the button again.

icon
Instructor Details

John Christopher

John Christopher is a Technical Instructor that has been in the business for 25 years. His first experience with information technology occurred in the early 90s when he ran an MS-DOS based BBS(Bulletin Board System) as a System Operator. In the late 90s, after working with Windows NT 3.50 performing backups for Regal Group, he decided to get Windows NT Microsoft Certified.

In 1998 he got his first Microsoft Certified Systems Engineer and Microsoft Certified Trainer certification. Shortly after getting certified, he began working as a Junior Administrator and Instructor for Knowledge Alliance. From there John was able to become one of the first people in the world to gain an MCSE for the Windows 2000 operating system and he began teaching full time for a company called Productivity Point International. At Productivity Point, John got Citrix Metaframe certified and began teaching Citrix along with Microsoft classes. Productivity Point began experiencing financial troubles and John moved on to work with another training company in 2001

icon
More courses by John Christopher

$17.99

$13.99

$14.99

$11.99

$14.99

$10.99

icon
More Hacking courses

$109.99

$27.99

$14.99

$84.99

$15.99

$11.99

icon
Reviews

4.6

1,863 ratings on Udemy

Select a bar to show only those reviews.Select the bar again to show every rating.

By Tim Dobbs on 8/25/2026

I learned a lot about Microsoft Defender. It helps me to understand what our Cybersecurity team is looking at when they review our systems and user accounts. thanks for the SIMs and the general overview of how to build out a test tenant environment on M365.

By Rob S on 5/27/2026

Udemy said I could not get a refund for this course because of the following: "This course is not eligible for a refund based on your viewing history. In accordance with our refund policy, you have watched too much of this course to request a refund." I watched 7 videos are realized that this course was outdated and in the trainers defense it is very difficult to keep up with the rate Microsoft changes stuff. This may be the last Udemy course I purchase. I have bought a lot of courses and they can't be trusted anymore.

By Carlos Eduardo on 1/7/2026

I like the fact that the instructor starts explaining the very foundations of the content. It makes it easier to understand the concepts and the evolution of the technologies leading to this day.

By Jaher Ullah on 11/25/2025

You need to improve your method of training... always give example or LAB on scenario basis not walkthrough what is there is Microsoft or Azure portal...which help learner like me to understand or grasp the content. Thanks

By James Douglas on 10/29/2025

The course is a good introduction into the world of Defender in a business environment, but to fit every detail in the course would be huge. Highly recommend following this course up with some official documentation from Microsoft themselves.

By Sheri Owen on 6/3/2025

This was a really good course for exploring the various iterations of Microsoft's Defender platform. John has a great cadence to his lectures and offers good support for hands on exploration. It's covers several items in depth, but mostly, it's super broad, so if you want to know where things are, what roles are needed with a good overview of how and why and what, this is worth the time.

By Paras Mani Arbinda on 1/4/2025

very good explanation on every product and features. I would like to have more info on when they got introduced as I am not sure if some of these products are already retired or replaced by some new name.

By Oluwaseyi Adetunji on 12/27/2024

I love all your courses and videos I bought John, but please try and do more practicals for some modules, especially to the ones you said its out of the scope of the course. Thank you, you deserve the 5 stars

By Kevin Moulder on 6/20/2024

Alright, I debated even leaving a review but, I love JC and his content so I want him and others to know about this course. The suggestion question was "is this course a fit for you". The answer is yes and no. I am a IT support technician or whatever term HR is using these days, which basically means I support systems and the end users. I am heavily involved in MS side of things from managing users to cyber incidents. I live in the portals every day, review logs and make sure nothing goes bump in the night. With that being said, I am also heavily relying on JC and his courses to fill in gaps where MS documentation melts my brain and I just need to know something. The long and short of it, JC I love your content, love the work you are doing and I hope your channel gets big and popular! But this course was a little disappointing (for me). I felt like there was a lot more time spent in Azure portal with Defender for Cloud covering different apps instead of security.microsoft.com portal. I would personally make a separate series covering Purview since that was in here as well. JC has said that M$ will change things weekly, monthly, etc.. and that even documentation isn't matching, but some of this content is minimum 6 months old to 10 months old (from the time of my viewing in June 2024. I know its not easy for him to make updated content when he is making new content for other certs and working as a consultant so I understand. I rated it as what I expected because its the basic overview of all the knobs and buttons in defender, where to look for certain things and its not in depth. JC knows his stuff and I cant wait for more in depth courses. I bought 4 of his courses at once and picked up one of his free offerings. I think its the SC 100 which I am starting this week. IF you are looking to get into Defender, the course is only 9 hours and it will give you a good overview of where you need to get started. Its worth the money for newbies. Thanks!

By Sotha on 1/20/2024

It is well paced. I think, I would prefer if all the disclaimer are in the first few videos. What I mean is I get it that I won't have the same licenses/VM than you or that the naming convention from MS is changing, I don't need to hear about in most videos. I also get that not all of the us learn the same way, so some might benefit from hear it. I took a half star off because some element, I would like to dig a bit deeper. I get there are a lots of features to go through but it would be nice to see how an investigation is done from start to finish or audit a server for some changes. Sure I can read on my own, but then what is the purpose on this course. Maybe I am more a hands-on learner. Regardless, overall I think it's a good class but you definitely need to have some knowledge about Azure.

Showing all 10 reviews on CourseDuck

Read all 1,863 reviews on Udemy

icon
Quality Score

No CourseDuck member has rated this course yet. Taken it? Give each part a thumbs up or down.

Content Quality
/
Video Quality
/
Qualified Instructor
/
Course Pace
/
Course Depth & Coverage
/

Overall Score : 92 / 100