Become a Microsoft Defender for Office 365 Ninja!

[ang31a]

If you've already completed the training, you can focus on the latest updates (January 2022 update).

Do you want to become a Microsoft Defender for Office 365 ninja? We can help you get there! We collected content for two roles: “Security Operations (SecOps)” and “Email Security" teams. The content is structured into three different knowledge levels (Fundamentals, Intermediate, and Advanced) with multiple modules per level. Some of the topics are relevant for SecOps as well as for Email Security teams. This training will be updated on a regular basis to ensure you have access to the most current information available.

Short Link:  aka.ms/MDONinja

NEW: After each level, we will offer you a knowledge check based on the training material you have just finished! Since there’s a lot of content, the goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. Lastly, there’ll be a fun certificate issued at the end of the training! Disclaimer: This is not an official Microsoft certification and only acts as a way of recognizing your participation in this training content.

Note: Threat protection product names from Microsoft have recently changed. Read more about this and other updates here. 

• Microsoft 365 Defender (previously Microsoft Threat Protection)

• Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)

• Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)

• Microsoft Defender for Identity (previously Azure Advanced Threat Protection)

• Microsoft Defender for Cloud Apps (previously Microsoft Cloud Apps Security)

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

P.S. I wanted to give my colleague, @Heike Ritter a big thank you for laying the groundwork for Ninja Training and for all of her help, along with @Giulian Garruba & @Bruno Nowak! Thank you!

_____________________________________________________________________________________

Table of Contents

Email Security - Fundamentals

(Deployment / Migration) 

Module 1. Technical overview 

Module 2. Getting started 

(Prevention & Detection) 

Module 3. Configuration (Part I) 

Module 4. Protection Feature

(Awareness) 

Module5. General Awareness 

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II) 

Module 2. Alert Management 

Module 3. Mail flow 

Module 4. Zero Hour Auto-Purge (ZAP) 

(Investigation & Hunting) 

Module 5. Investigating Alerts 

Module 6. Advanced hunting (overview)

Module 7. Automated Investigation and Remediation (AIR) 

Module 8. Threat Insights 

(Response & Remediation) 

Module 9. Alert Handling 

Module 10. Manage Quarantined Messages 

(Reporting) 

Module 11. Reporting 

Security Operations - Advanced

(SOC Flows) 

Module 1. SIEM Integration & APIs 

Module 2. False Positive/False Negative Management Flows 

Module 3. Automation 

Module 4. Migration 

(Investigation & Hunting)

Module 5. Advanced hunting (Kusto training) 

(Training) 

Module 6. Attack Simulation Training 

(Awareness) 

Module 7. General Awareness

(Supplemental)

Supplemental Content (Tech Community links)

Legend:

Docs on Microsoft	Blogs on Microsoft
Product videos	Webcast recordings
Tech Community	Interactive guides
⤴ External	GitHub

Email Security - Fundamentals

(Deployment / Migration) 

Module 1. Technical overview 

•  Understanding where Microsoft Defender for Office 365 fits in the Microsoft 365 Security Center
•  What is Microsoft Defender for Office 365? 
•  Introducing Microsoft Defender for Office 365 
•  Secure by default in Office 365 
•  The unified Microsoft 365 security center overview 
•  Interactive guide to Microsoft Defender for Office 365 
•  Get the most out of Office 365 ATP (Microsoft Defender for Office 365) in the shift to remote work 
  

Module 2. Getting started 

•  Evaluate Microsoft Defender for Office 365 
•  Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365 
•  ORCA (Office 365 Advanced Threat Protection Recommended Configuration Analyzer)
• ⤴ Reviewing your configuration with ORCA 
•  Enhanced Filtering for Connectors: Supporting hybrid mail routing configurations in Office 365 
•  Threat Explorer and Real-time detections 

(Prevention & Detection) 

Module 3. Configuration (Part I)

•  Mastering Configuration in Microsoft Defender for Office 365 
•  Mastering Configuration Blog Series [New!]
•  Preset security policies in Exchange Online Protection and Microsoft Defender for Office 365 
•  Recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 security 
•  Protect against threats
•  Report messages and files to Microsoft 
•  User submissions policies (add-in for end users) 
•  Use Admin Submission to submit suspected spam, phish, URLs, and files to Microsoft

Module 4. Protection Feature

•  Protect against malicious links with Safe Links in Microsoft Defender for Office 365

(Awareness) 

Module 5. General Awareness

•  Protecting against coronavirus themed phishing attacks 
•  New Threat analytics report shares the latest intelligence on recent nation-state cyber attacks 
•  Safety tips in email messages
•  New Home for Microsoft Defender for Office 365 [New!]

>Ready for the Fundamentals Knowledge Check?

 ____________________________________________________________________________________________

Email Security - Intermediate

(Prevention & Detection) 

Module 1. Configuration (Part II)

•  Email authentication (SPF, DMARC, DKIM) 
•  Configure outbound spam filtering 
•  Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365 

Module 2. Alert Management

•  Managing Alerts: Alert policies in the Security & Compliance Center 
•  Managing alerts in Microsoft Defender for Office 365
•  Announcing Priority Account Protection in Defender for Office 365 
•  Protect your most visible and most targeted user with Microsoft Defender for 365

 Module 3. Mail flow

•  Outbound spam protection in Exchange Online Protection 
•  Mail flow insights in the Security & Compliance Center 
•  Mail flow rules (transport rules) in standalone Exchange Online Protection 
•  Message trace in the Security & Compliance Center 

Module 4. Zero-Hour Auto Purge

•  Zero-Hour Auto Purge (ZAP) in Exchange Online 
•  Zero-Hour Auto Purge (ZAP) in Microsoft Defender for Office 365

(Investigation & Hunting) 

Module 5. Investigating Alerts

•  Get more out of Microsoft Defender for Office 365 with Microsoft 365 Defender 
•  Investigating alerts 
•  Incident correlation with Microsoft Defender for Office 365
•  Microsoft Defender for Office 365 investigation improvements coming soon
•  Investigate malicious email that was delivered in Office 365 

Module 6. Advanced Hunting (overview)

•  Microsoft Defender for Office 365 gets even better with Incidents and Advanced Hunting 
•  Hunting in Microsoft Defender for Office 365 

Module 7. Automated Investigation and Remediation

•  AIR Overview: Automated investigation and response (AIR) in Microsoft Defender for Office 365
•  How automated investigation and response works in Microsoft Defender for Office 365 
•  Details and results of an automated investigation in Microsoft 365 
•  Self-healing in Microsoft 365 Defender 

Module 8. Threat Insights

•  Walkthrough - Spoof intelligence insight in Microsoft Defender for Office 365 
•  Business Email: Uncompromised – Part One 
•  Business Email: Uncompromised – Part Two 
•  Business Email: Uncompromised – Part Three 
•  How to prevent business email compromise using Microsoft Defender for Office 365 

(Response & Remediation) 

Module 9. Alert handling

•  Remediation actions in Microsoft Defender for Office 365 
•  Review and manage remediation actions in Office 365
•  Quickly identify compromised users and sophisticated campaigns
•  Campaign Views in Microsoft Defender for Office 365
•  Announcing Campaign Views and Compromised User Detection and Response
•  Detect and respond to compromise in Microsoft Defender for Office 365 

Module 10. Manage quarantined messages

•   Manage quarantined messages and files as an administrator
•   Managing the user quarantine in Microsoft Defender for Office 365
•   Manage the admin quarantine in Microsoft Defender for Office 365        

(Reporting) 

Module 11. Reports / Custom Reporting

•   Smart reports and insights in the Security & Compliance Center
•   View Defender for Office 365 reports in the Reports dashboard in the Security & Compliance Center
•   Reporting an email in Microsoft Defender for Office 365 [New!]

>Ready for the Intermediate Knowledge Check?

 ____________________________________________________________________________________________

Security Operations - Advanced

(SOC Flows) 

Module 1. SIEM Integration & APIs

•  Say hello to the new Microsoft Threat Protection APIs!
•  Best practices for leveraging Microsoft 365 Defender API's - Episode One
•  Best practices for leveraging Microsoft 365 Defender API's - Episode Two
•  Improve the Effectiveness of your SOC with Office 365 ATP and the O365 Management API
•  Custom or third-party reporting solutions for Microsoft Defender for Office 365

Module 2. False Positive / False Negative Management Flows

•  Manually submit messages to Microsoft for analysis (FP/FN submission)
•  Handle FPs/FNs: How to report false positives/negatives in automated investigation and response capa... 

Module 3. Automation

•  Use Office Advanced Threat Protection automation for efficient Incident Response

Module 4. Migration [New!]

•  Introducing the Microsoft Defender for Office 365 Migration Guide [New!]
•  Microsoft Defender for Office 365 Migration Overview [New!]
•  Migration from a third-party protection Service to Microsoft Defender for Office 365[New!]

(Investigation & Hunting) 

Module 5. Advanced Hunting (Kusto training)

•  KQL part 1 of 3: Learn the KQL you need (part of Azure Sentinel webinar series)
•  KQL part 2 of 3: KQL hands-on lab exercises (part of Azure Sentinel webinar series)
•  KOL part 3 of 3: Optimizing KQL queries (part of Azure Sentinel webinar series)       
•  ⤴ Pluralsight KQL training 

(Training) 

Module 6. Attack Simulation Training

•  Attack simulation training in Microsoft Defender for Office 365 now Generally Available
•   Attack Simulation Training with Microsoft [New!]
•  Get started using Attack Simulation Training in Microsoft Defender for Office 365
•  Setting up a New Phish Simulation Program - Part One
•  Setting up a New Phish Simulation Program - Part Two

(Awareness)

Module 7. General Awareness [New!]

•  Improving your SecOps efficiency with Defender for Office 365 Workflow) [New!]
•  Microsoft Defender for Office 365 The Unified SecOps Experience [New!]

>Ready for the Experts Knowledge Check?

 ____________________________________________________________________________________________

Supplemental Content

•  Microsoft Defender for Office 365 - Microsoft Tech Community
•  Microsoft Security and Compliance - Microsoft Tech Community
•  Microsoft Defender for Office 365 - Homepage

Once you’ve finished the training and the knowledge checks, please click here to request your certificate. You'll see it in your inbox within 3-5 business days.

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

Interested in other ninja trainings? There are also ninja trainings for: 

Microsoft Defender for Endpoint (MDE) - http://aka.ms/mdeninja 

Microsoft Defender for Cloud Apps (MDCA) - http://aka.ms/mdcaninja 

Microsoft Defender for Identity (MDI) - http://aka.ms/mdininja

Follow us on LinkedIn as #DefenderForOffice365. Bookmark the Security blog to keep up with expert coverage on security matters. Also, follow @MSFTSecurity on Twitter and Microsoft Security on LinkedIn for the latest news and updates on cybersecurity. 

[ang31a]

If you've already completed the training, you can focus on the latest updates (January 2022 update).

Do you want to become a Microsoft Defender for Office 365 ninja? We can help you get there! We collected content for two roles: “Security Operations (SecOps)” and “Email Security" teams. The content is structured into three different knowledge levels (Fundamentals, Intermediate, and Advanced) with multiple modules per level. Some of the topics are relevant for SecOps as well as for Email Security teams. This training will be updated on a regular basis to ensure you have access to the most current information available.

Short Link:  aka.ms/MDONinja

NEW: After each level, we will offer you a knowledge check based on the training material you have just finished! Since there’s a lot of content, the goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. Lastly, there’ll be a fun certificate issued at the end of the training! Disclaimer: This is not an official Microsoft certification and only acts as a way of recognizing your participation in this training content.

Note: Threat protection product names from Microsoft have recently changed. Read more about this and other updates here. 

• Microsoft 365 Defender (previously Microsoft Threat Protection)

• Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)

• Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)

• Microsoft Defender for Identity (previously Azure Advanced Threat Protection)

• Microsoft Defender for Cloud Apps (previously Microsoft Cloud Apps Security)

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

P.S. I wanted to give my colleague, @Heike Ritter a big thank you for laying the groundwork for Ninja Training and for all of her help, along with @Giulian Garruba & @Bruno Nowak! Thank you!

_____________________________________________________________________________________

Table of Contents

Email Security - Fundamentals

(Deployment / Migration) 

Module 1. Technical overview 

Module 2. Getting started 

(Prevention & Detection) 

Module 3. Configuration (Part I) 

Module 4. Protection Feature

(Awareness) 

Module5. General Awareness 

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II) 

Module 2. Alert Management 

Module 3. Mail flow 

Module 4. Zero Hour Auto-Purge (ZAP) 

(Investigation & Hunting) 

Module 5. Investigating Alerts 

Module 6. Advanced hunting (overview)

Module 7. Automated Investigation and Remediation (AIR) 

Module 8. Threat Insights 

(Response & Remediation) 

Module 9. Alert Handling 

Module 10. Manage Quarantined Messages 

(Reporting) 

Module 11. Reporting 

Security Operations - Advanced

(SOC Flows) 

Module 1. SIEM Integration & APIs 

Module 2. False Positive/False Negative Management Flows 

Module 3. Automation 

Module 4. Migration 

(Investigation & Hunting)

Module 5. Advanced hunting (Kusto training) 

(Training) 

Module 6. Attack Simulation Training 

(Awareness) 

Module 7. General Awareness

(Supplemental)

Supplemental Content (Tech Community links)

Legend:

Docs on Microsoft	Blogs on Microsoft
Product videos	Webcast recordings
Tech Community	Interactive guides
⤴ External	GitHub

Email Security - Fundamentals

(Deployment / Migration) 

Module 1. Technical overview 

•  Understanding where Microsoft Defender for Office 365 fits in the Microsoft 365 Security Center
•  What is Microsoft Defender for Office 365? 
•  Introducing Microsoft Defender for Office 365 
•  Secure by default in Office 365 
•  The unified Microsoft 365 security center overview 
•  Interactive guide to Microsoft Defender for Office 365 
•  Get the most out of Office 365 ATP (Microsoft Defender for Office 365) in the shift to remote work 
  

Module 2. Getting started 

•  Evaluate Microsoft Defender for Office 365 
•  Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365 
•  ORCA (Office 365 Advanced Threat Protection Recommended Configuration Analyzer)
• ⤴ Reviewing your configuration with ORCA 
•  Enhanced Filtering for Connectors: Supporting hybrid mail routing configurations in Office 365 
•  Threat Explorer and Real-time detections 

(Prevention & Detection) 

Module 3. Configuration (Part I)

•  Mastering Configuration in Microsoft Defender for Office 365 
•  Mastering Configuration Blog Series [New!]
•  Preset security policies in Exchange Online Protection and Microsoft Defender for Office 365 
•  Recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 security 
•  Protect against threats
•  Report messages and files to Microsoft 
•  User submissions policies (add-in for end users) 
•  Use Admin Submission to submit suspected spam, phish, URLs, and files to Microsoft

Module 4. Protection Feature

•  Protect against malicious links with Safe Links in Microsoft Defender for Office 365

(Awareness) 

Module 5. General Awareness

•  Protecting against coronavirus themed phishing attacks 
•  New Threat analytics report shares the latest intelligence on recent nation-state cyber attacks 
•  Safety tips in email messages
•  New Home for Microsoft Defender for Office 365 [New!]

>Ready for the Fundamentals Knowledge Check?

 ____________________________________________________________________________________________

Email Security - Intermediate

(Prevention & Detection) 

Module 1. Configuration (Part II)

•  Email authentication (SPF, DMARC, DKIM) 
•  Configure outbound spam filtering 
•  Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365 

Module 2. Alert Management

•  Managing Alerts: Alert policies in the Security & Compliance Center 
•  Managing alerts in Microsoft Defender for Office 365
•  Announcing Priority Account Protection in Defender for Office 365 
•  Protect your most visible and most targeted user with Microsoft Defender for 365

 Module 3. Mail flow

•  Outbound spam protection in Exchange Online Protection 
•  Mail flow insights in the Security & Compliance Center 
•  Mail flow rules (transport rules) in standalone Exchange Online Protection 
•  Message trace in the Security & Compliance Center 

Module 4. Zero-Hour Auto Purge

•  Zero-Hour Auto Purge (ZAP) in Exchange Online 
•  Zero-Hour Auto Purge (ZAP) in Microsoft Defender for Office 365

(Investigation & Hunting) 

Module 5. Investigating Alerts

•  Get more out of Microsoft Defender for Office 365 with Microsoft 365 Defender 
•  Investigating alerts 
•  Incident correlation with Microsoft Defender for Office 365
•  Microsoft Defender for Office 365 investigation improvements coming soon
•  Investigate malicious email that was delivered in Office 365 

Module 6. Advanced Hunting (overview)

•  Microsoft Defender for Office 365 gets even better with Incidents and Advanced Hunting 
•  Hunting in Microsoft Defender for Office 365 

Module 7. Automated Investigation and Remediation

•  AIR Overview: Automated investigation and response (AIR) in Microsoft Defender for Office 365
•  How automated investigation and response works in Microsoft Defender for Office 365 
•  Details and results of an automated investigation in Microsoft 365 
•  Self-healing in Microsoft 365 Defender 

Module 8. Threat Insights

•  Walkthrough - Spoof intelligence insight in Microsoft Defender for Office 365 
•  Business Email: Uncompromised – Part One 
•  Business Email: Uncompromised – Part Two 
•  Business Email: Uncompromised – Part Three 
•  How to prevent business email compromise using Microsoft Defender for Office 365 

(Response & Remediation) 

Module 9. Alert handling

•  Remediation actions in Microsoft Defender for Office 365 
•  Review and manage remediation actions in Office 365
•  Quickly identify compromised users and sophisticated campaigns
•  Campaign Views in Microsoft Defender for Office 365
•  Announcing Campaign Views and Compromised User Detection and Response
•  Detect and respond to compromise in Microsoft Defender for Office 365 

Module 10. Manage quarantined messages

•   Manage quarantined messages and files as an administrator
•   Managing the user quarantine in Microsoft Defender for Office 365
•   Manage the admin quarantine in Microsoft Defender for Office 365        

(Reporting) 

Module 11. Reports / Custom Reporting

•   Smart reports and insights in the Security & Compliance Center
•   View Defender for Office 365 reports in the Reports dashboard in the Security & Compliance Center
•   Reporting an email in Microsoft Defender for Office 365 [New!]

>Ready for the Intermediate Knowledge Check?

 ____________________________________________________________________________________________

Security Operations - Advanced

(SOC Flows) 

Module 1. SIEM Integration & APIs

•  Say hello to the new Microsoft Threat Protection APIs!
•  Best practices for leveraging Microsoft 365 Defender API's - Episode One
•  Best practices for leveraging Microsoft 365 Defender API's - Episode Two
•  Improve the Effectiveness of your SOC with Office 365 ATP and the O365 Management API
•  Custom or third-party reporting solutions for Microsoft Defender for Office 365

Module 2. False Positive / False Negative Management Flows

•  Manually submit messages to Microsoft for analysis (FP/FN submission)
•  Handle FPs/FNs: How to report false positives/negatives in automated investigation and response capa... 

Module 3. Automation

•  Use Office Advanced Threat Protection automation for efficient Incident Response

Module 4. Migration [New!]

•  Introducing the Microsoft Defender for Office 365 Migration Guide [New!]
•  Microsoft Defender for Office 365 Migration Overview [New!]
•  Migration from a third-party protection Service to Microsoft Defender for Office 365[New!]

(Investigation & Hunting) 

Module 5. Advanced Hunting (Kusto training)

•  KQL part 1 of 3: Learn the KQL you need (part of Azure Sentinel webinar series)
•  KQL part 2 of 3: KQL hands-on lab exercises (part of Azure Sentinel webinar series)
•  KOL part 3 of 3: Optimizing KQL queries (part of Azure Sentinel webinar series)       
•  ⤴ Pluralsight KQL training 

(Training) 

Module 6. Attack Simulation Training

•  Attack simulation training in Microsoft Defender for Office 365 now Generally Available
•   Attack Simulation Training with Microsoft [New!]
•  Get started using Attack Simulation Training in Microsoft Defender for Office 365
•  Setting up a New Phish Simulation Program - Part One
•  Setting up a New Phish Simulation Program - Part Two

(Awareness)

Module 7. General Awareness [New!]

•  Improving your SecOps efficiency with Defender for Office 365 Workflow) [New!]
•  Microsoft Defender for Office 365 The Unified SecOps Experience [New!]

>Ready for the Experts Knowledge Check?

 ____________________________________________________________________________________________

Supplemental Content

•  Microsoft Defender for Office 365 - Microsoft Tech Community
•  Microsoft Security and Compliance - Microsoft Tech Community
•  Microsoft Defender for Office 365 - Homepage

Once you’ve finished the training and the knowledge checks, please click here to request your certificate. You'll see it in your inbox within 3-5 business days.

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

Interested in other ninja trainings? There are also ninja trainings for: 

Microsoft Defender for Endpoint (MDE) - http://aka.ms/mdeninja 

Microsoft Defender for Cloud Apps (MDCA) - http://aka.ms/mdcaninja 

Microsoft Defender for Identity (MDI) - http://aka.ms/mdininja

Follow us on LinkedIn as #DefenderForOffice365. Bookmark the Security blog to keep up with expert coverage on security matters. Also, follow @MSFTSecurity on Twitter and Microsoft Security on LinkedIn for the latest news and updates on cybersecurity. 

[ang31a]

• Microsoft 365 Defender (previously Microsoft Threat Protection)

• Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)

• Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)

• Microsoft Defender for Identity (previously Azure Advanced Threat Protection)

• Microsoft Defender for Cloud Apps (previously Microsoft Cloud Apps Security)