Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete−

Learning path 06 · Connect logs to Microsoft Sentinel ↗

7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence

Study focus

Data onboarding

Select and configure connectors for Microsoft services, Defender, Windows, CEF, and Syslog sources.

Collection reliability

Plan agents, data collection rules, forwarding, destination tables, threat indicators, and ingestion validation.

7 modules · 49 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Connect data to Microsoft Sentinel using data connectors0/6 units+02Connect Microsoft services to Microsoft Sentinel0/8 units+03Connect Microsoft Defender XDR to Microsoft Sentinel0/8 units−04Connect Windows hosts to Microsoft Sentinel0/7 units+05Connect Common Event Format logs to Microsoft Sentinel0/5 units+06Connect Syslog data sources to Microsoft Sentinel0/7 units+07Connect threat indicators to Microsoft Sentinel0/8 units+

Module 3

Connect Microsoft Defender XDR to Microsoft Sentinel

Focus: unified and Azure portal integration, Defender for Cloud and IoT, and legacy connector replacement.

0/8

01 / 08Introduction

Defender connectors bring cross-domain incidents and alerts into Sentinel and can optionally ingest raw events for hunting, correlation, and analytics.

Official moduleDefender connector objectives

02 / 08Plan for Microsoft Defender XDR connectors

The primary Microsoft Defender XDR connector covers Endpoint, Identity, Office 365, Cloud Apps, and other integrated alert providers. Plan whether you need bidirectional incident synchronization, alerts only, raw advanced-hunting events, or entity data.

Individual Defender for Endpoint, Identity, Office 365, and Cloud Apps alert connectors are legacy. Prefer the unified XDR connector to avoid independently managed duplicate incidents and missing raw data.

Official lessonDefender integration decisions

03 / 08Connect the Microsoft Defender XDR connector

When Sentinel is onboarded to the Defender portal and properly licensed, the XDR connector is configured automatically and individual alert-provider connectors are disconnected. For Azure-portal integration, install the Defender XDR solution and explicitly connect incidents and alerts.

Incidents are synchronized across portals, including title, severity, tags, selected metadata, and new comments.
Optional events and entities support hunting and UEBA.
Incident creation rules for integrated Microsoft products should be disabled to avoid duplicates.
Normal incident appearance is typically within five minutes; table ingestion can take longer.

Official lessonUnified connection and synchronization

04 / 08Connect Microsoft Defender for Cloud connector

Connect selected subscriptions to stream Defender for Cloud security alerts into Sentinel for workbooks, KQL, analytics, incidents, and response. Enable bidirectional synchronization when status changes should flow between products.

Official lessonCloud workload alert connection

05 / 08Connect Microsoft Defender for IoT

Connect the subscription to ingest Defender for IoT alerts and use built-in content for alert trends, severity breakdowns, top alerts, and IoT security recommendations.

Official lessonIoT alerts and recommendations

06 / 08Connect Microsoft Defender legacy connectors

Legacy product connectors sent alerts only, did not ingest raw telemetry, and could create separate Sentinel incidents that had to be managed independently from Defender incidents. Replace them with the Microsoft Defender XDR connector wherever supported.

Official lessonLegacy limitations and migration rationale

07 / 08Module assessment

Review automatic versus manual XDR integration, synchronized incidents, optional raw data, duplicate prevention, Defender for Cloud and IoT connections, and legacy limitations.

Official assessmentDefender connector knowledge check

08 / 08Summary and resources

Use the unified XDR connector as the central Defender integration and deliberately control incident, alert, entity, and raw-event ingestion to balance coverage and cost.

Official moduleSummary and resources

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete+

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+