The SC-200 in-company training teaches your security analysts how to investigate, respond to and hunt for cyberthreats using Microsoft Sentinel, Microsoft Defender XDR and Microsoft Defender for Cloud. The training teaches you Kusto Query Language (KQL) for detection, analysis and reporting. The official Microsoft course lasts 4 days and prepares for the Microsoft Certified: Security Operations Analyst Associate certification.

Who is this training for?

Suitable for security analysts, SOC analysts and IT professionals who perform threat management, monitoring and response in a Microsoft security environment. Basic knowledge of Microsoft 365, Microsoft Entra ID and Azure services is required. Minimum 4 and maximum 12 participants per group.

What will your employees be able to do after this training?

• Implement and configure Microsoft Sentinel as a SIEM/SOAR platform
• Write KQL queries for threat hunting, detection and reporting
• Create analytics rules, workbooks and playbooks in Microsoft Sentinel
• Manage and investigate incidents in Microsoft Sentinel
• Use Microsoft Defender XDR for endpoint, identity and email security
• Configure Microsoft Defender for Endpoint for EDR and threat investigation
• Implement Microsoft Defender for Identity for Active Directory security
• Configure Microsoft Defender for Office 365 for email security
• Use Microsoft Defender for Cloud Apps for cloud application security
• Implement Microsoft Defender for Cloud for multi-cloud security posture management
• Conduct threat hunting with advanced hunting in Microsoft Defender XDR

Course content

Day 1: Microsoft Defender XDR
Understanding Microsoft Defender XDR as a centralised incident management platform. Configuring Microsoft Defender for Endpoint: onboarding, policies and EDR features. Investigating and remediating endpoint incidents. Implementing Microsoft Defender for Identity for Active Directory threat detection. Configuring Microsoft Defender for Office 365 for email security.

Day 2: Microsoft Defender for Cloud Apps and Defender for Cloud
Implementing Microsoft Defender for Cloud Apps for shadow IT detection and app governance. Configuring Microsoft Defender for Cloud for multi-cloud security posture. Analysing security alerts and following up recommendations. Monitoring regulatory compliance in Defender for Cloud.

Day 3: Implementing Microsoft Sentinel
Creating a Microsoft Sentinel workspace and configuring data connectors for Microsoft 365, Azure and third-party sources. Creating analytics rules for threat detection. Configuring workbooks for security dashboards. Implementing automation rules and playbooks with Logic Apps for automated response.

Day 4: KQL, Threat Hunting and Incident Response
Writing KQL queries for log analysis, threat hunting and detection. Using advanced hunting in Microsoft Defender XDR. Conducting incident investigation with entity behaviour analytics (UEBA). Integrating threat intelligence via TAXII and STIX. Preparation for the SC-200 certification exam.

Practical information

• Duration: 4 days (8 sessions of 3 hours)
• Location: at your location, in Almere, Zwolle, Groningen, Utrecht, Enschede, Den Bosch, Breda, Meppel or Eindhoven (surcharge applies for locations outside Almere)
• Group size: minimum 4, maximum 12 participants per group
• Multiple groups on the same day are possible
• Course materials: available as an option
• Labs: available as an option
• Exam: on location at OEM in Almere or online via remote proctoring

What is included?

• Microsoft Gold certified trainer at your location
• Certificate of participation for each participant upon completion
• Free intake in advance
• Training evaluation upon completion

Course materials, labs and exam vouchers are available as an additional option.

SLIM subsidy

As a Dutch SME, you may be eligible for the SLIM subsidy for ICT training. The Dutch government reimburses 60% of your training costs, up to a maximum of €24,999. Period 2 opens 10 August 2026.

Related training courses

• SC-900: Microsoft Security, Compliance and Identity Fundamentals - recommended preparation
• AZ-500: Microsoft Azure Security Technologies
• SC-300: Microsoft Identity and Access Administrator

Request a quote via our quote form or contact us via our contact page. Or ask Sanne, our AI assistant - available 24/7 via the blue icon at the bottom right of the page.