We may earn an affiliate commission when you visit our partners.
Course image
John Christopher

We really hope you'll agree, this training is way more than the average course on Udemy.

Have access to the following:

  • Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified Trainer

  • Lecture that explains the concepts in an easy to learn method for someone that is just starting out with this material

  • Instructor led hands on and simulations to practice that can be followed even if you have little to no experience

  • Understanding the Microsoft 365 and Azure Environment

  • Read more

    We really hope you'll agree, this training is way more than the average course on Udemy.

    Have access to the following:

    • Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified Trainer

    • Lecture that explains the concepts in an easy to learn method for someone that is just starting out with this material

    • Instructor led hands on and simulations to practice that can be followed even if you have little to no experience

  • Understanding the Microsoft 365 and Azure Environment

  • A Solid Foundation of Active Directory Domains

  • A Solid Foundation of

  • High level overview of Microsoft Defender for Endpoint

  • Licensing and Plan Comparison (P1 vs P2)

  • Microsoft 365 Defender Portal Tour

  • How Defender for Endpoint relates to Microsoft Intune

  • Introduction to Microsoft Intune for device management

  • Setting Up Defender for Endpoint

    • Prerequisites and Supported Operating Systems

    • Creating a Microsoft Defender Admin role for permissions

    • Onboarding a Windows device to Defender for Endpoint

    • Mass automatic onboarding with Microsoft Intune

    • Verifying Windows devices have been onboarded

    • Implementing device discovery

    Defender for Endpoint Vulnerability Management

    • What are Common Vulnerabilities and Exposures (CVEs)?

    • Inspecting vulnerabilities on a specific device

    • Using the vulnerability management dashboard for high level overview

    • Improving security with the help of vulnerability recommendations

    • Utilizing remediation within vulnerability management

    • Creating and managing Device Groups for Defender for Endpoint

    Configuration and Policy Management

    • Hardening endpoint security by using Endpoint Security Policies

    • Attack Surface Reduction (ASR) Rules

    • What is Next-Gen Protection with Microsoft Defender for Endpoint?

    • Understanding the local anti-virus settings on Windows 11

    • Implementing Next-Gen Protection for devices

    • Understanding the local Defender Firewall settings on Windows 11

    • Implementing Firewall Rule Policies using Defender for Endpoint

    • Using Security Baselines in securing our devices

    Utilizing Microsoft Purview Endpoint DLP (Data Loss Prevention)

    • Understanding the concepts of DLP (Data Loss Prevention)

    • Considering device requirements before using Endpoint DLP

    • Settings for configuring Endpoint DLP

    • Configuring DLP policies with advanced rules

    • Enabling just-in-time (JIT) protection

    • How to monitor for endpoint activities

    Incident Response and Investigation

    • What is Automated Investigation and Remediation (AIR)?

    • Implementing Automated Investigation and Remediation (AIR) within device groups

    • Triggering incidents using a client device for testing

    • Investigating incidents generated by Defender managed devices

    • Viewing alerts generated by Defender managed devices

    • Managing and classifying detected alerts

    Kusto Query Language (KQL)

    • What is Kusto Query Language (KQL)?

    • Using the Microsoft KQL Demo environment, downloading resource materials and AI

    • Basic KQL syntax for searching for information

    • Summarizing KQL results and filtering based on time ranges

    • Controlling KQL data displayed based on columns, amounts and characters

    • Using KQL variables and combining output data

    • Running Threat Hunting Queries with Advanced Hunting (KQL)

    • Utilizing Microsoft's Sentinel and Defender repository of premade KQL Queries

    Enroll now

    What's inside

    Learning objectives

    • Learn the concepts and perform hands on activities needed to master microsoft defender for endpoint
    • Gain a tremendous amount of knowledge involving microsoft defender for endpoint
    • Learn using hands on simulations on how microsoft defender for endpoint is administered!
    • Learn how to set up your own test lab for practicing the concepts!

    Syllabus

    Introduction
    Welcome to the course!
    Understanding the Microsoft 365 and Azure Environment
    A Solid Foundation of Active Directory Domains
    Read more

    Save this course

    Create your own learning path. Save this course to your list so you can find it easily later.
    Save

    Career center

    Learners who complete Microsoft Defender for Endpoint course with hands on sims will develop knowledge and skills that may be useful to these careers:

    Reading list

    We've selected 50 books that we think will supplement your learning. Use these to develop background knowledge, enrich your coursework, and gain a deeper understanding of the topics covered in Microsoft Defender for Endpoint course with hands on sims.
    Delivers a comprehensive 2025 engineering playbook for managing Windows, iOS, macOS, and Android endpoints, Windows Autopilot provisioning, and Intune Suite capabilities. Authored by enterprise mobility MVPs to guide administrators through Zero Trust device compliance.
    Provides task-oriented recipes for Win32 app packaging, Settings Catalog policy creation, proactive remediations, and automated management via Microsoft Graph API and PowerShell. Ideal for endpoint engineers automating repetitive tenant operations.
    Comprehensive guide covering the entire incident response lifecycle, from preparation to analysis and remediation. It's a foundational text, offering insights into creating incident response plans and handling various incident types. The inclusion of real-world case studies makes it highly practical for understanding incident handling and resolution. It is considered a classic in the field and is often recommended for those seeking a broad understanding.
    Covers modern cloud-native workplace architecture, Windows 11 and Windows 365 Cloud PC management, Endpoint Privilege Management, and co-management migration from Configuration Manager. Equips enterprise architects to modernize legacy Active Directory estates.
    Offers a hands-on approach to threat hunting, specifically focusing on utilizing the MITRE ATT&CK Framework and open-source tools. It's highly practical and relevant for contemporary threat hunting practices, providing guidance on setting up environments and performing hunts. It's well-suited for those looking to deepen their practical skills.
    Must-read for anyone interested in EDR. It covers the basics of endpoint security and the importance of EDR, then dives into advanced areas like EDR architecture and popular tools. It includes real-world case studies and best practices, making it valuable for both beginners and experienced professionals.
    Draws on a Microsoft Intune product manager's perspective to explain enrollment workflows, app protection policies (MAM), conditional access integration, and Windows Update for Business rings. Offers a clear foundational onboarding path for new Intune administrators.
    Directly addresses the integration of threat intelligence and threat hunting into incident response. It covers theoretical concepts and real-life scenarios, focusing on using intelligence to enhance hunting procedures. It's a highly relevant book for understanding contemporary threat hunting practices.
    Dives into contemporary topics by exploring techniques used to evade Endpoint Detection and Response (EDR) systems. Understanding these techniques is crucial for building more robust endpoint defenses. It's a valuable resource for advanced students and security professionals looking to understand the attacker's perspective.
    Offers comprehensive insights into Microsoft Defender for Endpoint, a leading cross-platform endpoint security solution. It covers the product's history, features, deployment, and operationalization. It is particularly relevant for organizations using or planning to use Microsoft's security stack and provides practical guidance for security professionals and incident responders.
    Provides a CLI reference for Microsoft Defender for Endpoint. It covers everything from CLI commands to CLI syntax. It is written by the Microsoft team and valuable resource for anyone who wants to manage this security tool from the command line.
    Is specifically focused on the topic of threat hunting, making it highly relevant. It covers both basic and advanced techniques and includes downloadable data sets and scenario templates for practical application. While geared towards penetration testers, the techniques and methodologies are directly applicable to threat hunting. It serves as a strong resource for those looking to gain a broad understanding and deepen their skills.
    Aligns directly with Microsoft's modern desktop management certification, detailing Microsoft Entra join states, Intune device configuration profiles, BitLocker encryption, and Windows Autopilot deployment. Prepares IT pros for production enterprise device management.
    Provides a PowerShell reference for Microsoft Defender for Endpoint. It covers everything from PowerShell cmdlets to PowerShell syntax. It is written by the Microsoft team and valuable resource for anyone who wants to manage this security tool from PowerShell.
    This framework comprehensive guide to vulnerability management. It provides guidance on all aspects of vulnerability management, from identification to mitigation. It valuable resource for anyone involved in cybersecurity.
    Provides a deep dive into the technical aspects of cloud security. It covers topics such as cloud security architectures, security controls, and threat detection and response.
    Provides a comprehensive overview of cloud security, covering everything from basic concepts to advanced topics such as threat detection and incident response. It is an excellent resource for anyone who wants to learn more about cloud security.
    Known as the 'Blue Team Bible,' this handbook offers tactical advice and procedures for incident response. It covers various frameworks, detailed detection and analysis steps, and recovery processes. Its concise format makes it a valuable quick reference during actual incidents, helping analysts respond swiftly and effectively.
    Contextualizes Intune endpoint compliance within the wider Microsoft 365 security plane, detailing Microsoft Entra ID Conditional Access, Defender threat policies, and hybrid identity governance. Equips administrators to coordinate tenant-wide zero-trust controls.
    Emphasizes the importance of integrating threat intelligence into incident response to better understand and outwit adversaries. It discusses the F3EAD (Find, Fix, Finish, Exploit, Analyze, and Disseminate) model and highlights how CTI drives better IR outcomes.
    Walks step by step through tenant setup, RBAC role assignments, mobile application deployment, compliance reporting, and device wipe actions in the Microsoft Intune admin center. Offers practical administrative checklists for daily endpoint operations.
    Delves into the challenges of balancing security and usability in endpoint protection. It provides practical recommendations and tips for successful implementation of endpoint security measures. This book is particularly useful for professionals involved in designing and deploying security solutions.
    Delves into theoretical concepts alongside attacker motivations and techniques. It provides information on preparation and action during a security incident. Topics covered include memory analysis, disk analysis, and log collection and analysis, offering a deeper dive into practical incident response methodologies.
    Focusing on Network Security Monitoring (NSM), this book is crucial for understanding incident detection through network traffic analysis. It covers collection, detection, and analysis, providing a solid foundation for a key component of incident response. is valuable for those looking to deepen their technical skills in network-based investigations.
    Explores Windows 11 security baselines, TPM 2.0 and virtualization-based security, provisioning packages, and Policy CSP underpinnings that Intune configures remotely. Helps endpoint administrators understand the operating system mechanics behind every MDM policy toggle.
    Threat intelligence critical input for effective threat hunting. delves into the concepts and applications of threat intelligence, which helps hunters understand the threat landscape and develop relevant hypotheses. It provides foundational knowledge for anyone involved in threat hunting.
    Focuses on securing microservices, which are increasingly deployed on various endpoints. It covers API endpoint security in the context of microservices architectures. This relevant topic for those dealing with modern application development and deployment on endpoints.
    Focusing on the practical application of threat intelligence, this book is valuable for threat hunters who need to operationalize intelligence within their security programs. It provides guidance on integrating intelligence into workflows and decision-making, directly supporting hunting efforts.
    Comprehensive guide to using Microsoft Defender for Endpoint to protect cloud environments. It provides a number of step-by-step examples that show how to use Microsoft Defender for Endpoint to detect and respond to threats in the cloud.
    Provides a comprehensive and proven approach to securing network endpoints. It covers a wide range of endpoint devices and offers strategies to prevent and eliminate network contamination. It's a valuable reference for understanding the foundational concepts of endpoint security and different endpoint types.
    Practical guide to vulnerability management for security professionals. It covers all the essential steps involved in vulnerability management, from scanning and assessment to patching and remediation.
    Takes a threat-informed approach to vulnerability management. It covers topics such as threat intelligence, threat modeling, and vulnerability assessment.
    Provides a practical guide to implementing and managing a DLP program, covering topics such as policy development, data discovery, and incident response.
    Given that malware common element in cyber intrusions, understanding malware analysis is vital for incident responders. teaches readers how to create secure analysis environments and utilize key analysis tools with practical examples and real-world malware dissections.
    Provides a deep understanding of memory forensics, a specialized but critical area in incident response for detecting and analyzing malware and threats. It covers fundamentals and offers hands-on guidance across multiple operating systems.
    This handbook serves as a condensed guide for security operations teams, covering SOC, SIEM, and threat hunting. It's a practical reference for those working in a SOC environment and directly addresses threat hunting concepts and techniques. Its focus on the operational aspects makes it a valuable tool for practitioners.
    Demonstrates how to provision, harden, and govern Windows 365 Cloud PCs and Azure Virtual Desktop hosts directly through Microsoft Intune baselines, compliance rules, and Conditional Access. Essential reading for teams securing cloud-streamed enterprise workspaces.
    Introduces core MDM and MAM concepts, BYOD versus corporate-owned enrollment scenarios, and app configuration policies in a concise format. Suitable for helpdesk technicians and junior sysadmins transitioning into cloud device management.
    Explores a major real-world cyberattack campaign, providing insights into the tactics, techniques, and procedures (TTPs) of a sophisticated threat actor. Understanding real-world attacks is crucial for contemporary threat hunting, as it informs hypothesis generation and detection strategies. It's highly relevant for understanding the current threat landscape.
    Establishes the foundational enterprise OS imaging, driver injection, and task sequence architecture that preceded modern Windows Autopilot provisioning. Guides engineers migrating legacy MDT and Configuration Manager estates toward cloud-first Intune management.
    Unpacks the Windows kernel, registry hive architecture, security reference monitor, and service control manager running beneath every managed Windows endpoint. Gives senior Intune engineers the low-level diagnostic fluency required to troubleshoot complex MDM failures.
    Provides a detailed account of the Stuxnet attack, a landmark event in cyber warfare. Understanding the technical details and impact of such a sophisticated attack is valuable for threat hunters to recognize similar techniques and understand the potential consequences of their work. It's a classic case study relevant to contemporary threats.
    Teaches systems engineers how to write modular PowerShell scripts, query REST APIs, and handle execution errors cleanly. Directly applicable to authoring Intune platform scripts, custom compliance detection scripts, and Microsoft Graph automation.
    Comprehensive guide to vulnerability management in the cloud. It covers all the key concepts and best practices for securing cloud environments.
    Provides a hands-on approach to cloud security. It covers topics such as cloud security assessment, cloud security testing, and cloud security incident response.
    Provides a comprehensive overview of cloud security compliance. It covers topics such as cloud security standards, cloud security regulations, and cloud security audits.
    Maps Microsoft's integrated security, identity, and compliance stack across Entra ID, Intune device protection, and Microsoft Defender XDR. Clarifies how cloud-managed endpoint posture interacts with identity protection and Purview governance for certification prep.
    Focuses on the security and privacy challenges faced by enterprises that are adopting cloud computing. It provides practical guidance on how to protect data, applications, and infrastructure in the cloud.
    Provides a comprehensive overview of Microsoft Azure Security Center. It covers topics such as Azure Security Center architecture, security monitoring, and threat detection and response.

    Share

    Help others find this course page by sharing it with your friends and followers:

    Similar courses

    Here are nine courses similar to Microsoft Defender for Endpoint course with hands on sims.

    Udemy Buyer Protection & Guarantee

    Verified partner policies & purchase protections

    Global Marketplace Leader
    Free Trial & Audit

    Free Lecture Previews

    Free preview video lectures available for all courses; optional 7-day free trial on Personal Plan subscriptions (cancel before trial ends to avoid conversion).

    Return & Refund Policy

    30-Day Money-Back Guarantee

    30-day money-back guarantee on all eligible individual course purchases (provided course content has not been substantially consumed or downloaded). Subscription fees are non-refundable once billed.

    Buyer Protections

    Verified Academic & Industry Partner

    Lifetime access to purchased individual courses and future updates, verifiable certificate of completion, and direct student Q&A forums.

    Key Purchase Protections
    30-day 100% money-back guarantee on course purchases
    Lifetime access on web, mobile, and offline
    Certificate of completion included with purchase
    Direct instructor Q&A and active student community
    OpenCourser Verified Partner Policy details last reviewed: 2026-10-22
    Our mission

    OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.

    Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.

    Find this site helpful? Tell a friend about us.

    Affiliate disclosure

    We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.

    Your purchases help us maintain our catalog and keep our servers humming without ads.

    Thank you for supporting OpenCourser.

    © 2016 - 2025 OpenCourser