IDENTITY INVESTIGATION & AI AGENTS

Microsoft 365 & Entra ID Incident Investigation

Investigate session compromise, device-code phishing, application access and mailbox fraud. Use supervised AI agents to examine evidence, challenge findings and verify response decisions.

Available now6 chapters1.4 h18 lessonsEnglish

Open course →Explore the course topics ↓

After this course, learners will…

What learners can do

Investigate suspicious sign-ins, session theft, device-code phishing, application access and mailbox abuse in Microsoft 365 and Entra ID.
Direct an AI agent through a bounded investigation and verify each finding against the supplied identity and audit evidence.
Build a scoped response plan, check whether access persists and produce a report another responder can reproduce.

Benefits for your company

Responders can distinguish compromised credentials, sessions and application permissions before choosing a containment action.
AI-assisted findings remain traceable to records, reducing reliance on plausible but unsupported summaries.
Identity, messaging and incident teams gain a shared evidence trail for coordinated containment and recovery.

INSIDE THE COURSE

Explore the course, chapter by chapter.

6 chapters · 18 lessons1.4 hExercises take additional time.

Build your skills in sequence, practise with the supplied cases and verify your decisions. Explore the chapters and lesson objectives below.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Set up the investigation

0.2 h

Define the decision, understand the evidence and configure a bounded agent.

1.1

Decision and evidence

Open the case with a decision, a deadline and a boundary

7 slides · 3 practical activities · Knowledge checks

Create an investigation brief that an analyst and an agent can both follow.

Includes practical AI use, verification and information risks.

Link to this lesson

Know which identity and which evidence you are looking at

7 slides · 3 practical activities · Knowledge checks

Map an identity event to the right source without confusing authentication, permission and resource use.

Includes practical AI use, verification and information risks.

Link to this lesson

1.2

Agent setup and authority

Configure an investigator agent you can supervise

7 slides · 3 practical activities · Knowledge checks

Set up a bounded evidence-reading workflow with enforceable permissions and a reproducible run record.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 02

Case 1: Session compromise

0.2 h

Separate an authentication success from legitimate subsequent use.

2.1

Hypotheses and timeline

Investigate suspicious sessions without blaming the wrong user

7 slides · 3 practical activities · Knowledge checks

Test a session-compromise hypothesis against sign-in context and a benign comparison.

Includes practical AI use, verification and information risks.

Link to this lesson

Build a timeline that survives a skeptical reviewer

7 slides · 3 practical activities · Knowledge checks

Join identity and mailbox observations while preserving time and coverage limitations.

Includes practical AI use, verification and information risks.

Link to this lesson

2.2

Containment and verification

Recommend containment and verify what it changed

7 slides · 3 practical activities · Knowledge checks

Separate approved response actions from evidence that the relevant access path stopped.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 03

Case 2: Device-code phishing

0.2 h

Investigate intent, test queries and handle hostile content safely.

3.1

Authorization and query testing

Recognize device-code abuse on a genuine sign-in page

7 slides · 3 practical activities · Knowledge checks

Investigate authorization intent without relying on a fake-domain explanation.

Includes practical AI use, verification and information risks.

Link to this lesson

Use an agent to draft queries, then test the query

8 slides · 3 practical activities · Knowledge checks

Validate query scope, fields and positive/negative cases before trusting the result.

Topics you will explore

Inspect a read-only KQL proposal

Includes practical AI use, verification and information risks.

Link to this lesson

3.2

Prompt injection in evidence

Stop a malicious email becoming an agent instruction

7 slides · 3 practical activities · Knowledge checks

Detect indirect prompt injection and verify the tool boundary with a controlled failure test.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 04

Case 3: Application access

0.2 h

Distinguish principal identity, permission and actual resource activity.

4.1

Identity, grants and use

Identify the application before judging its permissions

7 slides · 3 practical activities · Knowledge checks

Separate app identity, tenant-local service principal and permission mode.

Includes practical AI use, verification and information risks.

Link to this lesson

Trace consent to observed use

7 slides · 3 practical activities · Knowledge checks

Correlate a permission grant with resource activity without inflating the impact claim.

Includes practical AI use, verification and information risks.

Link to this lesson

4.2

Path-specific response

Contain the right access path

7 slides · 3 practical activities · Knowledge checks

Draft separate response proposals for delegated user access and application-only activity.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 05

Case 4: Mailbox and payment fraud

0.2 h

Investigate persistence, assess impact and coordinate the response.

5.1

Mailbox access and exposure

Investigate mailbox rules and delegated access

7 slides · 3 practical activities · Knowledge checks

Assess mailbox persistence and distinguish configured actions from successful effects.

Includes practical AI use, verification and information risks.

Link to this lesson

Describe data exposure without inventing certainty

7 slides · 3 practical activities · Knowledge checks

Produce a supported impact statement from mailbox access records and incomplete coverage.

Includes practical AI use, verification and information risks.

Link to this lesson

5.2

Cross-team response

Coordinate identity, messaging and finance response

7 slides · 3 practical activities · Knowledge checks

Turn technical findings into an authorized, verifiable response across teams.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 06

Operate and challenge the workflow

0.2 h

Evaluate agent assistance and demonstrate transfer to a new case.

6.1

Roles, tests and review

Build a small agent team without multiplying errors

7 slides · 3 practical activities · Knowledge checks

Assign useful agent roles while preserving evidence independence and human ownership.

Includes practical AI use, verification and information risks.

Link to this lesson

Test the workflow before making it routine

7 slides · 3 practical activities · Knowledge checks

Evaluate agent usefulness through evidence accuracy, bounded behavior and reviewer effort.

Includes practical AI use, verification and information risks.

Link to this lesson

6.2

Harbor Works assessment

Transfer the method to an unfamiliar tenant

7 slides · 3 practical activities · Knowledge checks

Produce an evidence-linked investigation and challenge an agent plan without relying on the worked Northstar answers.

Includes practical AI use, verification and information risks.

Link to this lesson

Available now

Built for practical work.

SOC analysts, incident responders and Microsoft 365 security administrators.

Before you start

SOC analysts, incident responders and Microsoft 365 security administrators who understand basic sign-in, MFA and mailbox administration. No live tenant or AI subscription is required for the core exercises.

How learning works

Self-paced lessons with readings, diagrams, practical activities and knowledge checks. Pause and resume at your own pace. Practice time varies; an overall study-time estimate has not yet been validated in a learner pilot.

Course price

€299 per person

Excluding VAT. Applicable VAT will be added.

Separate per-person course pricing. This course is not included in the standard company subscription. Contact the academy to arrange enrolment.

Course language: English
Enrolment: Contact the academy

English narration, captions, 18 practical lessons and a named completion certificate. Exercises use supplied evidence; completion requires studying the slides, recording your decisions and passing the knowledge check.

The certificate records course completion, not accreditation or an independently proctored professional certification.

Open course →Contact sales ↗

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.