Logo
Intermediate Live Course

Azure Security

Attack and defend the Microsoft cloud hands-on.

Watch Free Demo

Starting at $250 · Taught by industry-certified ThreatBlock instructors.

Trusted by teams at
South FloridaSynackLufthansaBooking HoldingsHCL TechWiproMicrosoftSouth FloridaSynackLufthansaBooking HoldingsHCL TechWiproMicrosoft
Highlights: 24h
Level: Intermediate
Batch: Max 18 Learners
Mode: Online Live

What You'll Learn

Azure & Entra ID Fundamentals
Azure Resource Manager hierarchy: management groups, subscriptions, resource groups, and resources. Entra ID (formerly Azure AD) identities, service principals, managed identities, and app registrations. The Azure RBAC model versus Entra roles. Setting up a lab tenant and navigating the portal, Azure CLI, and Microsoft Graph.
Identity Attacks on Entra ID
Password spraying and token theft against Entra ID with tools like MFASweep and AADInternals. Enumerating users, groups, and app registrations with ROADtools and AzureHound. Consent phishing and OAuth app abuse. Abusing overprivileged service principals and managed identities for privilege escalation.
Conditional Access & MFA Defense
Designing Conditional Access policies to enforce device compliance, location, and risk-based controls. Deploying phishing-resistant MFA and number matching. Identity Protection risk detections and sign-in risk policies. Closing legacy authentication and token replay gaps that attackers rely on.
Microsoft Defender Stack
Microsoft Defender for Cloud for posture management and Secure Score. Defender for Endpoint, Identity, and Cloud Apps working together as XDR. Hunting with Microsoft Sentinel and KQL queries over sign-in and audit logs. Building analytics rules and automated response playbooks.
Workload & Data Hardening
Securing storage accounts, key vaults, and managed identities against public exposure. Network security groups, Azure Firewall, and Private Endpoints to isolate workloads. Encryption at rest and in transit, plus Key Vault access policies and RBAC. Hardening virtual machines, containers, and App Service deployments.
Monitoring, IR & Governance
Centralizing logs with Azure Monitor and Log Analytics workspaces. Incident response workflows for a compromised Azure tenant. Governance with Azure Policy, Blueprints, and the Microsoft Cloud Security Benchmark. Capstone: attack a tenant, detect the activity in Sentinel, and remediate the misconfigurations.
Course Curriculum

What you'll master.

6 modules — tap any topic to expand the details.

Azure Resource Manager hierarchy: management groups, subscriptions, resource groups, and resources. Entra ID (formerly Azure AD) identities, service principals, managed identities, and app registrations. The Azure RBAC model versus Entra roles. Setting up a lab tenant and navigating the portal, Azure CLI, and Microsoft Graph.
Enroll Now
$250
Book your demo

One-time payment for full course access. Flexible EMI options available at checkout.

Reviews & Testimonial

Loved by hackers. Trusted by organizations.
Aditya Menon
Cloud Security Engineer
★★★★★

The Entra ID attack path followed straight by the Conditional Access defenses gave me both sides of the story. My tenant hardening improved immediately.

Priya Nambiar
SOC Analyst
★★★★★

Learning KQL hunting in Sentinel against real sign-in logs was the highlight. I now write my own analytics rules at work.

Harsh Agarwal
Azure Administrator
★★★★★

The Defender stack module finally connected Defender for Endpoint, Identity, and Cloud Apps for me. The XDR picture makes sense now.

Meera Pillai
Cloud Security Architect
★★★★★

Managed identity abuse and service principal escalation were eye-opening. This course changed how I review Azure RBAC assignments.

Nikhil Verma
DevSecOps Engineer
★★★★★

The capstone where we attack, detect, and remediate a tenant tied everything together. Easily the most practical Azure security training I have taken.

Aditya Menon
Cloud Security Engineer
★★★★★

The Entra ID attack path followed straight by the Conditional Access defenses gave me both sides of the story. My tenant hardening improved immediately.

Priya Nambiar
SOC Analyst
★★★★★

Learning KQL hunting in Sentinel against real sign-in logs was the highlight. I now write my own analytics rules at work.

Harsh Agarwal
Azure Administrator
★★★★★

The Defender stack module finally connected Defender for Endpoint, Identity, and Cloud Apps for me. The XDR picture makes sense now.

Meera Pillai
Cloud Security Architect
★★★★★

Managed identity abuse and service principal escalation were eye-opening. This course changed how I review Azure RBAC assignments.

Nikhil Verma
DevSecOps Engineer
★★★★★

The capstone where we attack, detect, and remediate a tenant tied everything together. Easily the most practical Azure security training I have taken.

Nikhil Verma
DevSecOps Engineer
★★★★★

The capstone where we attack, detect, and remediate a tenant tied everything together. Easily the most practical Azure security training I have taken.

Meera Pillai
Cloud Security Architect
★★★★★

Managed identity abuse and service principal escalation were eye-opening. This course changed how I review Azure RBAC assignments.

Harsh Agarwal
Azure Administrator
★★★★★

The Defender stack module finally connected Defender for Endpoint, Identity, and Cloud Apps for me. The XDR picture makes sense now.

Priya Nambiar
SOC Analyst
★★★★★

Learning KQL hunting in Sentinel against real sign-in logs was the highlight. I now write my own analytics rules at work.

Aditya Menon
Cloud Security Engineer
★★★★★

The Entra ID attack path followed straight by the Conditional Access defenses gave me both sides of the story. My tenant hardening improved immediately.

Nikhil Verma
DevSecOps Engineer
★★★★★

The capstone where we attack, detect, and remediate a tenant tied everything together. Easily the most practical Azure security training I have taken.

Meera Pillai
Cloud Security Architect
★★★★★

Managed identity abuse and service principal escalation were eye-opening. This course changed how I review Azure RBAC assignments.

Harsh Agarwal
Azure Administrator
★★★★★

The Defender stack module finally connected Defender for Endpoint, Identity, and Cloud Apps for me. The XDR picture makes sense now.

Priya Nambiar
SOC Analyst
★★★★★

Learning KQL hunting in Sentinel against real sign-in logs was the highlight. I now write my own analytics rules at work.

Aditya Menon
Cloud Security Engineer
★★★★★

The Entra ID attack path followed straight by the Conditional Access defenses gave me both sides of the story. My tenant hardening improved immediately.