Microsoft Defender Course with hands on training and sims (Udemy.com)
Learn how to expertly administer Microsoft Defender XDR (formerly Microsoft 365 Defender) with hands on experience!
Created by: John Christopher
Last updated October 2026
What you will learn
- Learn the concepts and perform hands on activities needed to master Microsoft Defender XDR (formerly Microsoft 365 Defender)
- Gain a tremendous amount of knowledge involving Microsoft Defender XDR (formerly Microsoft 365 Defender)
- Learn using hands on simulations on how Microsoft Defender XDR (formerly Microsoft 365 Defender) is administered!
- Learn how to set up your own test lab for practicing the concepts!
How it compares
Against the other 523 rated Udemy courses in Hacking on CourseDuck:
- Rating4.6 out of 5higher than 72% of them
- Reviews1,863#121 of 524 by number of reviews
- Length9.5 hourslonger than 69% of them
- Last updatedOctober 2026more recently than 99% of them
Course Description
We really hope you'll agree, this training is way more than the average course on Udemy!
Have access to the following:
Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified Trainer
Lecture that explains the concepts in an easy to learn method for someone that is just starting out with this material
Instructor led hands on and simulations to practice that can be followed even if you have little to no experience
TOPICS COVERED INCLUDING HANDS ON LECTURE AND PRACTICE TUTORIALS:
Introduction
Welcome to the course
Understanding the Microsoft Environment
Foundations of Active Directory Domains
Foundations of RAS, DMZ, and Virtualization
Foundations of the Microsoft Cloud Services
DONT SKIP: The first thing to know about Microsoft cloud services
DONT SKIP: Azure AD is now renamed to Entra ID
Questions for John Christopher
Performing hands on activities
DONT SKIP: Using Assignments in the course
Creating a free Microsoft 365 Account
Activating licenses for Defender for Endpoint and Vulnerabilities
Getting your free Azure credit
Basic concepts of the Microsoft Defender Suite and Services
The Microsoft 365 Defender Suite
Using the Defender and Purview admin centers
Microsoft Defender for Office 365
What is Microsoft Defender for Office 365?
Implementing policies for uses in Email, SharePoint, OneDrive, and Teams
Dealing with threats using Defender for Office 365
Performing a campaign email attack simulation in Microsoft Defender
Microsoft Defender for Cloud Apps and Data Loss Prevention (DLP)
Understanding the concepts of Microsoft Defender for Cloud Apps
Investigating security risks in Defender for Cloud Apps
Concepts of data loss prevention in Microsoft Defender
Alerts with data loss prevention policies (DLP)
Data loss prevention (DLP) policy alert investigation
Microsoft Defender for Endpoint and Defender Vulnerability Management
Understanding Microsoft Defender for Endpoint concepts
Deploy a Windows 11 VM endpoint
Attack surface reduction (ASR) support with Intune
Working with device onboarding regarding Defender for Endpoint
Something to be aware of about extra features
Endpoint advanced features, alerts and incidents
Endpoint vulnerabilities
Device attack surface reduction (ASR)
Device groups with Defender for Endpoint
Microsoft Defender Vulnerability Management risk identification
Endpoint threat indicators
Device discovery of unmanaged devices
Microsoft Identity Concepts
Microsoft Entra ID security risk mitigation
Concepts of using Microsoft Entra Identity Protection
Microsoft Entra Identity Protection security risk mitigation
Microsoft Entra Identity Protection risks in regards to Microsoft Defender
Microsoft Defender for Identity concepts
Using Defender for Identity to mitigate threats with AD DS
Microsoft 365 Defender as an Extended Detection and Response (XDR)
Visualizing the concepts of extended detection and responses (XDR)
Configuring the Microsoft 365 Defender simulation lab
Performing an attack using the simulation lab
Microsoft 365 Defender incidents and automated investigations
Microsoft 365 Defender action and submissions
Using Kusto Query Language (KQL) for threat identification
Microsoft Secure Score
Microsoft 365 Defender threat analytics
Custom detections and alerts
Getting started w/ Defender for Cloud, Defender for Servers & Defender for DevOps
Introduction to Microsoft Defender for Cloud
Regulatory compliance policies along with MCSB
Remediation's with secure score in Microsoft Defender for Cloud
Microsoft Defender for Servers
Microsoft Defender for DevOps
Microsoft Defender External Attack Surface Management (EASM)
Microsoft Defender for Cloud full management and configurations
Settings config in Microsoft Defender for Cloud
Roles in Microsoft Defender for Cloud
Cloud workload protection
Automation of onboarding Azure resource
Azure Arc connections
Multi-cloud connections
Email notifications in Microsoft Defender for Cloud
Using alert suppression rules
Workflow automation configuration in Defender for Cloud
Using sample alerts and incidents
Using Microsoft Defender for Cloud recommendations
Security alerts and incidents in Microsoft Defender for Cloud
Using threat intelligence reports with Microsoft Defender for Cloud
Dealing with insider risks in Microsoft 365
Concepts of insider risk policies
Insider risk policy generation
Insider risk policy alert investigation
Audit and search capabilities in Microsoft Defender and Microsoft Purview
Licensing of unified audit logging
Permissions for unified auditing
Threat hunting with unified audit logging
Threat hunting with Content Searches
Conclusion
Cleaning up your lab environment
Getting a Udemy certificate
BONUS Where do I go from here?
Instructor Details
- 4.6 Rating
1,863 Reviews
John Christopher
John Christopher is a Technical Instructor that has been in the business for 25 years. His first experience with information technology occurred in the early 90s when he ran an MS-DOS based BBS(Bulletin Board System) as a System Operator. In the late 90s, after working with Windows NT 3.50 performing backups for Regal Group, he decided to get Windows NT Microsoft Certified.
In 1998 he got his first Microsoft Certified Systems Engineer and Microsoft Certified Trainer certification. Shortly after getting certified, he began working as a Junior Administrator and Instructor for Knowledge Alliance. From there John was able to become one of the first people in the world to gain an MCSE for the Windows 2000 operating system and he began teaching full time for a company called Productivity Point International. At Productivity Point, John got Citrix Metaframe certified and began teaching Citrix along with Microsoft classes. Productivity Point began experiencing financial troubles and John moved on to work with another training company in 2001
More courses by John Christopher
Intune (MDM / MAM) Microsoft training course with HANDS ON (2026)
4.6 (17,077 Reviews)
Provider: Udemy
Time: 9.7h
$17.99
MD-102 Endpoint Administrator Associate course with SIMS! (2026)
4.6 (15,547 Reviews)
Provider: Udemy
Time: 14.3h
$13.99
Microsoft 365 Fundamentals: Real Skills and Hands-On Sims (2026)
4.6 (8,721 Reviews)
Provider: Udemy
Time: 9.5h
$14.99
MS-700 Managing Microsoft Teams Training & Lab Simulations (2026)
4.7 (8,211 Reviews)
Provider: Udemy
Time: 11.9h
$11.99
AB-650 & MS-102 Hands on Certification Course with Sims (2026)
4.7 (7,107 Reviews)
Provider: Udemy
Time: 18.5h
$14.99
SC-300 Course: Microsoft Identity and Access Administrator (2026)
4.7 (6,672 Reviews)
Provider: Udemy
Time: 16.5h
$10.99
More Hacking courses
Getting Started with Wireshark: The Ultimate Hands-On Course (2025)
4.8 (12,167 Reviews)
Provider: Udemy
Time: 4.4h
$109.99
The Ultimate Dark Web, Anonymity, Privacy & Security Course (2025)
4.8 (9,329 Reviews)
Provider: Udemy
Time: 10.3h
$27.99
Computer Basics for Beginners: Understanding Computer Basics (2025)
4.8 (4,524 Reviews)
Provider: Udemy
Time: 5.8h
$14.99
Ultimate F5 LTM Training from Beginner to Expert 2026
4.8 (1,927 Reviews)
Provider: Udemy
Time: 13.5h
$84.99
IP Addressing and Subnetting - Hands-on Learning Approach (2020)
4.8 (1,522 Reviews)
Provider: Udemy
Time: 4.2h
$15.99
Cisco BGP Masterclass for Enterprise Network Engineers (2026)
4.8 (1,369 Reviews)
Provider: Udemy
Time: 16.4h
$11.99
Reviews
By Tim Dobbs on 8/25/2026
I learned a lot about Microsoft Defender. It helps me to understand what our Cybersecurity team is looking at when they review our systems and user accounts. thanks for the SIMs and the general overview of how to build out a test tenant environment on M365.
By Rob S on 5/27/2026
Udemy said I could not get a refund for this course because of the following: "This course is not eligible for a refund based on your viewing history. In accordance with our refund policy, you have watched too much of this course to request a refund." I watched 7 videos are realized that this course was outdated and in the trainers defense it is very difficult to keep up with the rate Microsoft changes stuff. This may be the last Udemy course I purchase. I have bought a lot of courses and they can't be trusted anymore.
By Carlos Eduardo on 1/7/2026
I like the fact that the instructor starts explaining the very foundations of the content. It makes it easier to understand the concepts and the evolution of the technologies leading to this day.
By Jaher Ullah on 11/25/2025
You need to improve your method of training... always give example or LAB on scenario basis not walkthrough what is there is Microsoft or Azure portal...which help learner like me to understand or grasp the content. Thanks
By James Douglas on 10/29/2025
The course is a good introduction into the world of Defender in a business environment, but to fit every detail in the course would be huge. Highly recommend following this course up with some official documentation from Microsoft themselves.
By Sheri Owen on 6/3/2025
This was a really good course for exploring the various iterations of Microsoft's Defender platform. John has a great cadence to his lectures and offers good support for hands on exploration. It's covers several items in depth, but mostly, it's super broad, so if you want to know where things are, what roles are needed with a good overview of how and why and what, this is worth the time.
By Paras Mani Arbinda on 1/4/2025
very good explanation on every product and features. I would like to have more info on when they got introduced as I am not sure if some of these products are already retired or replaced by some new name.
By Oluwaseyi Adetunji on 12/27/2024
I love all your courses and videos I bought John, but please try and do more practicals for some modules, especially to the ones you said its out of the scope of the course. Thank you, you deserve the 5 stars
By Kevin Moulder on 6/20/2024
Alright, I debated even leaving a review but, I love JC and his content so I want him and others to know about this course. The suggestion question was "is this course a fit for you". The answer is yes and no. I am a IT support technician or whatever term HR is using these days, which basically means I support systems and the end users. I am heavily involved in MS side of things from managing users to cyber incidents. I live in the portals every day, review logs and make sure nothing goes bump in the night. With that being said, I am also heavily relying on JC and his courses to fill in gaps where MS documentation melts my brain and I just need to know something. The long and short of it, JC I love your content, love the work you are doing and I hope your channel gets big and popular! But this course was a little disappointing (for me). I felt like there was a lot more time spent in Azure portal with Defender for Cloud covering different apps instead of security.microsoft.com portal. I would personally make a separate series covering Purview since that was in here as well. JC has said that M$ will change things weekly, monthly, etc.. and that even documentation isn't matching, but some of this content is minimum 6 months old to 10 months old (from the time of my viewing in June 2024. I know its not easy for him to make updated content when he is making new content for other certs and working as a consultant so I understand. I rated it as what I expected because its the basic overview of all the knobs and buttons in defender, where to look for certain things and its not in depth. JC knows his stuff and I cant wait for more in depth courses. I bought 4 of his courses at once and picked up one of his free offerings. I think its the SC 100 which I am starting this week. IF you are looking to get into Defender, the course is only 9 hours and it will give you a good overview of where you need to get started. Its worth the money for newbies. Thanks!
By Sotha on 1/20/2024
It is well paced. I think, I would prefer if all the disclaimer are in the first few videos. What I mean is I get it that I won't have the same licenses/VM than you or that the naming convention from MS is changing, I don't need to hear about in most videos. I also get that not all of the us learn the same way, so some might benefit from hear it. I took a half star off because some element, I would like to dig a bit deeper. I get there are a lots of features to go through but it would be nice to see how an investigation is done from start to finish or audit a server for some changes. Sure I can read on my own, but then what is the purpose on this course. Maybe I am more a hands-on learner. Regardless, overall I think it's a good class but you definitely need to have some knowledge about Azure.
Quality Score
No CourseDuck member has rated this course yet. Taken it? Give each part a thumbs up or down.
Overall Score : 92 / 100












