Defender for Identity Labs

Mon, 27 Jan 2025 18:50:00 +0000

Deploying Defender for Identity is only part of the job. You also need to know what an alert looks like, what evidence to review, and what to do with it.

Microsoft’s TechExcel Defender for Identity lab gives you a structured way to practice that. Day 1 covers deployment and configuration. Day 2 walks through attack simulations, detection, and investigation, including reconnaissance, sensitive-group changes, credential access, and lateral movement.

The part I like here is that the exercises continue after generating an alert. For example, the lateral movement investigation has you review the alert story, related incident, and incident graph, then manage the alert. That’s useful practice for the people who will actually handle these in your environment.

Defender for Identity on Nathan McNulty

Defender for Identity Labs