What you'll learn

Fragmented logs, standing privilege, and unmanaged agent identities are the failures that turn a contained incident into a breach, and they usually belong to three different teams. In this course, SC-100: Designing Security Operations, Identity, and Compliance Capabilities, you'll gain the ability to design the detection, identity, privileged access, and compliance capabilities an enterprise can defend under audit and under attack. First, you'll explore how to design security operations as one estate, covering the split between XDR and SIEM, centralized logging and auditing with Microsoft Purview Audit, automation that returns analyst hours, and detection coverage measured against MITRE ATT&CK. Next, you'll discover how to design identity for human, workload, and agent principals, including agent identities with Microsoft Entra Agent ID, access across SaaS, PaaS, IaaS, hybrid, and multicloud resources, and external identities. Then, you'll learn how to design continuous authorization, harden the Active Directory forest everything else still trusts, and secure privileged access with the enterprise access model, entitlement management, and privileged access workstations. Finally, you'll learn how to translate regulatory obligations into controls you can enforce and evidence using Microsoft Purview, Azure Policy, and Microsoft Defender for Cloud. When you're finished with this course, you'll have the skills and knowledge of security operations, identity, and compliance design needed to architect and defend these capabilities across a hybrid and multicloud enterprise.