Security
Modern SecOps with Unified Platform
Intermediate
Microsoft SentinelModernize and optimize your SOC deployment with Microsoft Sentinel
Learn how to deploy, configure, and optimize Microsoft Sentinel using the new unified experience within the Microsoft Defender portal. This course equips technical teams to plan architecture, connect data sources, apply SIEM best practices, and operationalize an AI-ready SOC with improved visibility, integrated Defender workflows, and interactive simulated labs.
8 hours(Suggested: 2 days, 4h/day)TechnicalProject ReadyHands-on Labs
MS Course ID: 00356
Last Updated: Jan 12, 2026
Course Syllabus
1
Module 1: Modernizing your SOC with Microsoft Sentinel
• The threat landscape and SOC challenge
• Modernize the SOC to defend against the evolving threat landscape
• Microsoft Sentinel SIEM Overview
• Platform Architecture
• SIEM Key capabilities
• Detect, Investigate and Respond
• Unified Security Operations with Defender Portal
90 mins
Lecture
2
Module 2 - Planning for Sentinel Deployment
• Planning for Sentinel SIEM deployment
• Workspace Architecture Planning
• Sample workspace designs
• Prioritize Data Connectors
• Plan Data retention and data tiering models with Analytics and Data Lake
• Plan costs and understand billing
90 mins
Lecture
3
Hands-on Labs
• Microsoft Sentinel Deployment
60 mins
Lab
4
Module 3: Deploy and configure Microsoft Sentinel
• Manage roles and permissions
• Deploy Microsoft Sentinel SIEM
• Enable initial content
• Connect Microsoft Sentinel to the Microsoft Defender portal
• Introduction to Microsoft content hub solutions
• Connect data sources to Microsoft Sentinel
• Deploying a log forwarder
• AWS S3 connector - architecture overview
• Microsoft Security Store
• Get started with Microsoft Sentinel MCP server and tools
• Deploy Microsoft Sentinel Platform
• Microsoft Sentinel Graph (Preview) Overview
• Onboarding Sentinel to Data Lake and Graph
90 mins
Lecture
5
Module 4: SOC Optimizing and best practices
• Areas of Optimization in Microsoft Sentinel
• SIEM best practices in Microsoft Sentinel
• Microsoft Sentinel Use cases
90 mins
Lecture
6
Hands-on Labs
• Enabling Data Connectors in Microsoft Sentinel in Microsoft Defender Portal
• Getting a Connector via the Microsoft Security Store
60 mins
Lab
What You'll Learn
Understand core concepts and best practices
Hands-on experience with real-world scenarios
Learn from certified Microsoft experts
Prepare for relevant certifications
Access to lab environments
Post-training support and resources
Course Details
- Duration
- 8 hours
- Level
- Intermediate
- Role
- Technical
- Course Type
- Project Ready
- Partner Segment
- SMB, Enterprise
- Course Stage
- Available
- Hands-on Labs
- Yes
- ESI Course Code
- DW-350