Microsoft Sentinel Foundation Training
Understand where Microsoft Sentinel fits in the SOC, explain its architecture, and deploy a working workspace in the Microsoft Defender portal with your first data source connected.
- Level 1 of 4
- No prior Sentinel experience needed
- Live online: max 8-10 hours
- Corporate: 1 day
- Self-paced: 1-year LMS
- Curriculum updated 1 November 2026
Free demo class · Free 10-15 min fit call · Miss the batch? Join next month's · Pay by UPI, cards, net banking or PayPal
About Microsoft Sentinel Foundation Training
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR. It collects security data from Microsoft, multicloud and on-premises sources into a Log Analytics workspace, detects threats with analytics rules, groups alerts into incidents and automates response, all from the Microsoft Defender portal.
Foundation covers Day 1: why security operations need a SIEM, where Sentinel fits next to EDR, XDR and log management, its architecture from data sources to incidents, safe deployment planning and least-privilege access, and a first working workspace with a connected data source.
Training is hands-on: every day ends with lab evidence you keep, and a progression gate checks that you are ready for the next level. The course teaches the Defender portal experience, the one Microsoft is moving every customer to.
What you will be able to do after Foundation
Explain the SOC problem
Describe visibility gaps, alert fatigue and the lifecycle of a security event, using the terms SOC teams use every day.
Place Sentinel correctly
Compare SIEM with EDR, XDR and log management, and decide where Sentinel fits in Microsoft, multicloud and hybrid estates.
Draw the architecture
Trace the flow from data sources and connectors through Log Analytics to analytics, incidents and response in the Defender portal.
Plan a safe deployment
Choose tenant, subscription, region and workspace, and plan least-privilege roles before enabling anything.
Stand up a workspace
Create a Log Analytics workspace, enable Microsoft Sentinel and connect it to the Microsoft Defender portal.
Prove data is flowing
Connect a first Microsoft data source and record evidence of incoming events.
Private Microsoft Sentinel training for your security team
DevOpsSchool runs Microsoft Sentinel Foundation Training as a private, day-wise batch: 1 day covering Day 1. The agenda is aligned to your tenant, data sources and SOC processes.
- 1 day, day by day (Day 1), online or at your office
- A ready, paid lab environment provided by DevOpsSchool, so nobody waits on access
- Examples adapted to your connectors, detections and escalation process
- Progression gates with lab evidence for every participant
- Led by Rajesh Kumar: 200+ corporate trainings delivered
Teams we have trained
Teams trained in Splunk and DevSecOps at Wells Fargo, AstraZeneca, Citrix and John Deere, among 90+ companies on our client list.
Corporate batches are scheduled on demand. Tell us your team size and preferred dates and we reply within 1 hour.
Request a corporate quoteWhere Foundation sits in the Microsoft Sentinel path
Each level adds new days to the previous ones. Corporate days are cumulative; the self-paced plan includes all four levels.
- Level 1Foundation1 day corporateSOC context, architecture and workspace setupYou are here
- Level 2Essential2 days corporateKQL, built-in detections and incident triage
- Level 3Intermediate3 days corporateIngestion, correlation, enrichment and tuning
- Level 4Advanced5 days corporateASIM, hunting, SOAR and enterprise scale
Choose how you learn
The same agenda in three formats. Pick the one that fits your schedule and goals.
| Live online | Corporate | Self-paced | |
|---|---|---|---|
| Format | Instructor-led online sessions | Private batch for your team, online or onsite | Recorded video lessons in the LMS |
| Duration | Max 8 to 10 hours | 1 day (Day 1) | 1 year of LMS access |
| Schedule | Weekday batch on the 1st, weekend batch on the first Saturday of every month | On demand, on your dates | Start any day |
| Labs | Your own Azure free trial or local setup, set up with the trainer | Ready lab environment provided | Guided lab videos |
| Support | Live Q&A, WhatsApp, recordings for a year | Trainer and team Q&A throughout | LMS and email support |
| Best for | Individuals who want guidance and feedback | Security teams adopting Sentinel together | Busy schedules and self-starters |
1st of every month
Starts on the 1st of every month. Max 10 learners, so every lab gets reviewed.
first Saturday of the month
Starts on the first Saturday of every month, for working professionals. Max 10 learners.
On demand
Private sessions at a time that suits you. Ask us for availability.
Why Foundation-level Sentinel skills matter
Security teams receive more alerts than they can investigate, from tools that do not talk to each other. A SIEM such as Microsoft Sentinel brings that telemetry together so analysts can detect, investigate and respond in one place.
Organisations that run Microsoft 365, Azure or Microsoft Defender increasingly operate their SOC from Sentinel in the Defender portal, which makes the people who can deploy, query, tune and automate it central to the security team.
Understand where Sentinel fits in security operations, explain its architecture, and establish a working lab environment.
A small enterprise needs one place to view identity and Azure administration events before developing a full detection program.
Question this level answersWhy centralize security telemetry, detection, investigation, and coordinated response?
What you are expected to learn in Foundation
- Day 1: Understand where Sentinel fits in security operations, explain its architecture, and establish a working lab environment.
What you need before you start
- No prior Microsoft Sentinel experience is required
- Basic Azure and security literacy is helpful
- A laptop with a current browser
- An Azure free trial or Azure subscription where you can create a resource group and Log Analytics workspace (the trainer shows you how)
- Access to the Microsoft Defender portal with your account
Is Foundation the right level for you?
- Security analysts and SOC L1 staff who are new to Microsoft Sentinel
- Cloud and Azure administrators asked to set up or support Sentinel
- IT and security managers who need to understand SIEM in the Microsoft ecosystem
- Anyone preparing for a SOC role who has basic Azure and security literacy
Already deploying Sentinel workspaces and connecting data sources? Start with Essential instead.
Foundation agenda: Day 1
Microsoft Sentinel Foundation Training covers Day 1: 12 topics and 3 practical exercises. Corporate batches run day by day; the live online course covers the same topics in up to 8 to 10 hours.
Day 1 · Foundation (new at this level)Microsoft Sentinel Essentials, SOC Context, Architecture, and Initial Deployment12 topics · 3 labs
Day outcome: Understand where Sentinel fits in security operations, explain its architecture, and establish a working lab environment.
| ID | Topic | Coverage |
|---|---|---|
| F01 | The security operations problem | Security visibility gaps, alert fatigue, SOC mission, and lifecycle of a security event. |
| F02 | Fundamental security terminology | Telemetry, log, event, indicator, detection, alert, incident, case, false positive, and response action. |
| F03 | What Microsoft Sentinel provides | Cloud-native SIEM capabilities, unified security operations experience, key benefits, and fundamental limitations. |
| F04 | People and responsibilities | SOC L1/L2/L3 analysts, threat hunters, security engineers, cloud administrators, and service owners; basic ownership boundaries. |
| F05 | Where Sentinel fits and when to adopt it | Microsoft/Azure, multicloud, hybrid, and on-premises contexts; common organizational use cases. |
| F06 | Comparison with alternative approaches | SIEM versus endpoint-only monitoring, EDR/XDR, log management, and traditional SIEM; complementary rather than mutually exclusive tools. |
| F07 | Foundational platform architecture | Data sources → connectors → ingestion/Log Analytics → analytics → incidents → investigation and response; Defender portal interface. |
| F08 | Azure resource dependencies | Microsoft Entra tenant, subscription, resource group, Log Analytics workspace, region, and workspace association. |
| F09 | Prerequisites and deployment planning | Lab scope, account requirements, region selection, permissions, sample data, safe test practices, and awareness of ingestion costs. |
| F10 | Baseline access permissions | Least privilege concepts; basic Azure and Microsoft Sentinel roles; why owner and analyst access differ. |
| F11 | Initial workspace setup | Create or select a Log Analytics workspace, enable Sentinel, connect it to the Microsoft Defender portal, and confirm navigation. |
| F12 | First data connection | Activate one instructor-approved, straightforward Microsoft data source (for example Azure Activity, subject to access), observe connection status, and verify sample events arrive. |
Practical exercises
- Sketch the foundational Sentinel architecture and identify the responsibility of each component.
- Provision or access a dedicated training workspace, enable Microsoft Sentinel, and open the Defender portal experience.
- Connect an approved starter data source and record evidence of incoming events; use instructor-provided synthetic telemetry when a licensed source is unavailable.
You leave with: Architecture sketch, working Sentinel workspace, documented access model, and proof of first successful data ingestion.
One course, three ways to take it
INR is the reference price; your local currency is shown where it can be detected.
- Next batch on the 1st (weekday) or first Saturday (weekend)
- Max 10 learners per batch
- Guided labs and live Q&A
- Recordings in your LMS for a year
- All four Microsoft Sentinel levels included
- Access to 20+ other courses and 50+ tools
- Learn at your own pace, any day
- 1 day, day-wise (Day 1)
- Ready lab environment provided
- Agenda aligned to your tenant
- Can't attend your batch? Move to next month's batch.
- Every live session is recorded and stays in your LMS for a year.
- Free demo class before you pay.
- Pay by UPI, credit and debit cards, net banking or PayPal
- Refund policy
How you learn, and how your skills are checked
How sessions run
Instructor-led explanations, demonstrations, guided labs, assessment, and case studies, in the Microsoft Defender portal.
- Explain the concept, then demonstrate it in the Microsoft Defender portal
- You repeat it in a guided lab and keep the evidence
- A real-world case ties each day together
- Practice questions and mock exams aligned to the official SC-200 objectives
Assessment checkpoints
Skills are checked with checklists and observable lab evidence, not attendance alone. If you miss a prerequisite, a supervised remediation attempt is allowed.
| Checkpoint | Evidence | Next step |
|---|---|---|
| End of Day 1 | Architecture sketch, working Sentinel workspace, documented access model, and proof of first successful data ingestion. | Continue to Essential (Day 2). |
3 labs, each with evidence you keep
Labs build on each other: every lab produces evidence you keep, and later days reuse earlier lab artifacts.
Sketch the foundational Sentinel architecture and identify the responsibility of each component.
Provision or access a dedicated training workspace, enable Microsoft Sentinel, and open the Defender portal experience.
Connect an approved starter data source and record evidence of incoming events; use instructor-provided synthetic telemetry when a licensed source is unavailable.
Individuals set up their own lab on an Azure free trial or locally, and the trainer shows you how, step by step. Corporate batches get a ready lab environment. Azure ingestion and Logic Apps costs may apply beyond the free allowances.
Rajesh Kumar
Principal Architect, trainer and mentor in DevOps, SRE, DevSecOps and platform engineering, with 20 years across 8+ software MNCs, including Staff DevOps/SRE Engineer for a leading Japanese mobile-payment platform and Principal DevOps Architect and Manager in Europe. He leads this course and reviews its curriculum (last reviewed 1 November 2026).
Earn a verifiable Microsoft Sentinel certificate
Complete the labs and meet the Foundation checkpoint to receive a DevOpsSchool certificate of completion. Each certificate has a unique ID that employers can check in the DevOpsSchool certificate registry.
Preparing for Microsoft SC-200? Together, the four Microsoft Sentinel levels follow the Sentinel parts of the official SC-200 (Microsoft Security Operations Analyst) exam objectives, and mock exams are included. DevOpsSchool is an independent training provider and is not affiliated with Microsoft.
Verify a certificate
Real reviews, linked to where they were published
“Rajesh is very good trainer. Rajesh was able to resolve our queries and question effectively. We really liked the hands-on examples covered during this training program.”
“Very well organized training, helped a lot to understand the AWS concept and detailed related to various tools. Very helpful”
Quoted exactly as published on the DevOpsSchool testimonials page, from learners in Rajesh Kumar's live trainings across courses.
DevOpsSchool training compared with learning alone
Microsoft Learn's free documentation is excellent, and this course links to it throughout. What training adds is structure, guided labs, feedback and accountability.
| DevOpsSchool Microsoft Sentinel training | Learning alone from docs and videos | |
|---|---|---|
| Learning path | Four levels with a day-wise agenda and progression gates | You choose topics and order yourself |
| Help when you are stuck | Trainer answers in live sessions and on WhatsApp | Forums and search results |
| Labs | Guided labs, with help setting up your own Azure lab | Set up and debug alone |
| Missed a session | Recordings for a year, or move to next month's batch | Not applicable |
| Proof of skills | Verifiable certificate of completion | None |
| Exam practice | Mock exams aligned to the SC-200 objectives | Find your own |
Questions before you enrol
Do I need to complete the earlier levels first?
No. Foundation is the starting point. Basic Azure and security literacy helps, but no prior Sentinel experience is needed.
How long is the course?
Live online: up to 8 to 10 hours of instructor-led sessions. Corporate: 1 day, day by day (Day 1). Self-paced: one year of LMS access to all four levels.
When does the next batch start?
Weekday batches start on the 1st of every month and weekend batches on the first Saturday of every month. Each batch has at most 10 learners. One-to-one and corporate sessions are scheduled on demand.
What do I need for the labs?
Set up your own lab on an Azure free trial or locally, and the trainer shows you how, step by step. You need a Log Analytics workspace and access to the Microsoft Defender portal; Azure ingestion and Logic Apps costs may apply beyond the free allowances. Corporate batches get a ready lab environment.
What if I miss a live session?
Every live session is recorded and stays in your LMS for a year. If you cannot attend your batch, you can move to next month's batch.
Can I try it before I pay?
Yes. Join a free demo class, or book a free 10-15 minute call with an advisor or the trainer to check the course fits you. Payments follow our refund policy.
Does this prepare me for the SC-200 exam?
Together, the four Microsoft Sentinel levels follow the Sentinel parts of the official SC-200 (Microsoft Security Operations Analyst) exam objectives, and mock exams are included. DevOpsSchool is an independent training provider and is not affiliated with Microsoft.
How can I pay?
UPI, credit and debit cards, net banking or PayPal. Prices are in INR, and your local currency is shown for reference.
What does self-paced access include?
One year of complete LMS access, all four Microsoft Sentinel levels, plus 20+ other courses and 50+ tools.
Is the course up to date?
Yes. It teaches Microsoft Sentinel in the Microsoft Defender portal, which Microsoft has made the standard experience; Microsoft supports the Azure-portal experience only until 31 March 2027. The curriculum was last updated on 1 November 2026.
Talk to a person before you decide
We reply within 1 hour on WhatsApp and email. Free 10-15 minute call with an advisor or the trainer to check the course fits you.
Try it before you pay
Free demo class before you pay. Free 10-15 minute call with an advisor or the trainer to check the course fits you.
Book a free demo classRead more before or after the course
Official Microsoft documentation used in this level
Inside the course materials
Start Microsoft Sentinel Foundation Training
Weekday batch starts 1st of every month; weekend batch first Saturday of the month. Batches are capped at 10 learners so every lab gets reviewed.
Not ready yet? Ask for a free demo class or a free 10-15 minute call using the form.