All Training Courses

IT and security

SC-200T00 Microsoft Security Operations Analyst

Practice investigating and responding to threats using Microsoft security tools and KQL.

See class schedule · Live instructor-led training

What you will work on

  • Investigate incidents in Microsoft Defender
  • Hunt and analyze threats with KQL
  • Configure and use Microsoft Sentinel
  • Respond to identity, endpoint and cloud risks

What the course covers

Explore the curriculum to see how it fits the work you want to do.

1 - Introduction to Microsoft Defender XDR threat protection
  • Explore Extended Detection & Response (XDR) response use cases
  • Understand Microsoft Defender XDR in a Security Operations Center (SOC)
  • Explore Microsoft Security Graph
  • Investigate security incidents in Microsoft Defender XDR
  • Module assessment
2 - Mitigate incidents using Microsoft Defender
  • Use the Microsoft Defender portal
  • Manage incidents
  • Investigate incidents
  • Manage and investigate alerts
  • Manage automated investigations
  • Use the action center
  • Explore advanced hunting
  • Investigate Microsoft Entra sign-in logs
  • Understand Microsoft Secure Score
  • Analyze threat analytics
  • Analyze reports
  • Configure the Microsoft Defender portal
3 - Remediate risks with Microsoft Defender for Office 365
  • Automate, investigate, and remediate
  • Configure, protect, and detect
  • Simulate attacks
4 - Manage Microsoft Entra Identity Protection
  • Review identity protection basics
  • Implement and manage user risk policy
  • Monitor, investigate, and remediate elevated risky users
  • Implement security for workload identities
  • Explore Microsoft Defender for Identity
  • Module assessment
5 - Safeguard your environment with Microsoft Defender for Identity
  • Configure Microsoft Defender for Identity sensors
  • Review compromised accounts or data
  • Integrate with other Microsoft tools
6 - Secure your cloud apps and services with Microsoft Defender for Cloud Apps
  • Understand the Defender for Cloud Apps Framework
  • Explore your cloud apps with Cloud Discovery
  • Protect your data and apps with Conditional Access App Control
  • Walk through discovery and access control with Microsoft Defender for Cloud Apps
  • Classify and protect sensitive information
  • Detect Threats
  • Module assessment
7 - Introduction to generative AI and agents
  • Large language models (LLMs)
  • Prompts
  • AI agents
  • Module assessment
8 - Describe Microsoft Security Copilot
  • Get acquainted with Microsoft Security Copilot
  • Describe Microsoft Security Copilot terminology
  • Describe how Microsoft Security Copilot processes prompt requests
  • Describe the elements of an effective prompt
  • Describe how to enable Microsoft Security Copilot
  • Module assessment
9 - Describe the core features of Microsoft Security Copilot
  • Describe the features available in the standalone experience of Microsoft Security Copilot
  • Describe the features available in a session of the standalone experience
  • Describe workspaces
  • Describe the Microsoft plugins available in Microsoft Security Copilot
  • Describe the non-Microsoft plugins supported by Microsoft Security Copilot
  • Describe custom promptbooks
  • Describe knowledge base connections
  • Module assessment
10 - Describe the embedded experiences of Microsoft Security Copilot
  • Describe Copilot in Microsoft Defender XDR
  • Copilot in Microsoft Purview
  • Copilot in Microsoft Entra
  • Copilot in Microsoft Intune
  • Copilot in Microsoft Defender for Cloud (Preview)
  • Module assessment
11 - Explore use cases of Microsoft Security Copilot
  • Explore the first run experience
  • Explore the standalone experience
  • Explore Security Copilot workspaces
  • Configure the Microsoft Sentinel plugin
  • Enable a custom plugin
  • Explore file uploads as a knowledge base
  • Create a custom promptbook
  • Explore the capabilities of Copilot in Microsoft Defender XDR
  • Explore the capabilities of Copilot in Microsoft Purview
  • Explore the capabilities of Copilot in Microsoft Entra
  • Module assessment
12 - Investigate and respond to Microsoft Purview Data Loss Prevention alerts
  • Understand data loss prevention (DLP) alerts
  • Understand the DLP alert lifecycle
  • Configure DLP policies to generate alerts
  • Investigate DLP alerts in Microsoft Purview
  • Investigate DLP alerts in Microsoft Defender XDR
  • Investigate DLP alerts with Security Copilot and AI agents
  • Respond to DLP alerts
  • Module assessment
13 - Investigate insider risk alerts and related activity
  • Understand insider risk alerts and investigations
  • Manage alert volume in insider risk management
  • Investigate and triage insider risk alerts in Microsoft Purview
  • Investigate insider risk alerts with Security Copilot and AI agents
  • Analyze alert context with the All risk factors tab
  • Investigate activity details with the Activity explorer tab
  • Review patterns over time with the User activity tab
  • Investigate insider risk alerts in Microsoft Defender XDR
  • Manage and take action on insider risk cases
  • Module assessment
14 - Search and investigate with Microsoft Purview Audit
  • Microsoft Purview Audit overview
  • Configure and manage Microsoft Purview Audit
  • Conduct searches with Audit (Standard)
  • Audit Microsoft Copilot for Microsoft 365 interactions
  • Investigate activities with Audit (Premium)
  • Export audit log data
  • Configure audit retention with Audit (Premium)
  • Module assessment
15 - Search for content with Microsoft Purview eDiscovery
  • Understand eDiscovery and content search capabilities

Who this course is for

Security operations analysts and professionals working in a SOC.

Before you attend

Familiarity with Microsoft 365, security and identity concepts, Windows, Azure services and basic scripting.

Included with this course

  • Live instructor-led class
  • Microsoft course materials and lab access
  • SC-200 preparation and completion certificate
  • A preparation checklist for prerequisites, class access and setup
  • Altvina support for questions, concerns and next-step guidance

Exam vouchers are included only where listed. Certification eligibility is separate from course attendance.

Ongoing mentorship is a separate paid service.

Support from Altvina

Have a question about course fit, learner details or access? Our team is your contact for enrollment support.

Ask a Course Question

Payments, refunds and class changes

Clear payment dates

Pay a $50 deposit per learner or full tuition. With your explicit agreement, the remaining balance is charged seven days before class. You receive an advance reminder.

Flexible before the cutoff

Class payments are refundable until seven days before the start. After that they are non-refundable; contact Altvina if an issue arises.

If the scheduled class changes

If Altvina or the training provider cancels or materially changes your class, you can choose a refund or an alternative date. We will contact you to arrange your choice.

Training instruction is delivered by Logical Operations or the provider listed for the class. Altvina handles enrollment and customer support.

SC-200T00 Microsoft Security Operations Analyst | Altvina Training | Altvina