E-mmersion for Microsoft Defender for Identity: attack, detect and investigate identity threats
Identity is the path most attackers take from one compromised account to control of the domain. In this hands-on lab your team simulates reconnaissance, credential theft and lateral movement against Active Directory, then investigates every alert Microsoft Defender for Identity raises.
- Format
- Instructor-led hands-on lab
- Labs
- Lab 1 (light) and Lab 2 (full)
- Audience
- Technical decision-makers and IT professionals
- Where
- Controlled lab environment, guided by our experts
Real attacks, real alerts
Each exercise reproduces a technique seen in real intrusions and walks through the alert it triggers, the detection logic behind it and how to respond.
- Deploy and manage Microsoft Defender for Identity sensors in a controlled environment.
- User and IP address reconnaissance over SMB, exposing the SYSVOL access patterns attackers use to move laterally.
- Network mapping through DNS reconnaissance, including unauthorized AXFR zone transfers.
- Security principal reconnaissance over LDAP, the first phase of a Kerberoasting attack.
- Suspected DCSync attacks and suspicious connections over the EFS Remote Protocol.
- Data exfiltration over SMB, such as copying ntds.dit from a domain controller to a workstation.
How the lab runs
A structured session that moves from context, to hands-on attack simulation, to analysis with our experts.
Introduction and lab access
We set objectives, give an overview of Microsoft Defender for Identity, validate everyone’s access and tour the lab interface.
Hands-on exercises
Participants analyze security data, user activity and risk indicators, then simulate lateral movement, credential theft and reconnaissance and review the alerts in real time.
Scenario analysis and closing
We discuss detection logic, response strategies and mitigation practices, close with Q&A and key takeaways, and share resources for further training.
What your team takes away
Practical experience
Hands-on practice implementing and managing Defender for Identity sensors, beyond what documentation alone can teach.
Threat detection and analysis
The ability to spot anomalous behavior and investigate real-time alerts across reconnaissance, credential access, lateral movement and exfiltration.
An attacker’s view
A clear understanding of common identity attack vectors, gained by running lateral movement and credential theft scenarios yourself.
Built for identity defenders
- Technical decision-makers evaluating or expanding Microsoft Defender for Identity.
- IT and security professionals who run on-premises Active Directory or hybrid identity in Microsoft Entra ID.
- SOC analysts who triage identity alerts in Microsoft Defender XDR.
- Teams that want expert guidance and technical support throughout the session.
Where this lab fits
Defender for Identity is one layer of identity protection. These offerings extend the same work into AI-assisted operations, access controls and 24×7 response.
Book your E-mmersion lab
Tell us about your identity environment and what your team needs to practice. We will recommend the right lab and schedule the session.
Scoping callWe confirm objectives, participants and the identity environment you want the lab to reflect.
Lab selectionWe recommend Lab 1 (light) or Lab 2 (full) based on your team’s experience and goals.
Guided sessionOur experts run the lab with your team and provide technical support from start to finish.