Professional training – Windows Server & Microsoft Infrastructure

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint in 6 focused hours: Onboarding devices, Attack surface reduction and Endpoint detection and response – practical, with exercises and templates for your daily work.

Duration
6 hours, one session
Level
Intermediate
Format
Online or on-site
Language
German or English
Certificate
Certificate of attendance

Overview

“Microsoft Defender for Endpoint” is a compact live course in the field of Windows Server & Microsoft Infrastructure. It centres on Onboarding devices, Attack surface reduction and Endpoint detection and response – explained with realistic examples and deepened in exercises you can transfer straight to your daily work.

Windows Server, Active Directory and Microsoft cloud services form the foundation for identities, workplaces and collaboration in most organizations. Hybrid scenarios with Entra ID, Intune and Microsoft 365 noticeably raise the bar for administrators. Our Microsoft Defender for Endpoint courses are for teams who want to run, secure and automate directory services, servers and endpoints reliably. You work in a provided lab environment on typical operational tasks and failure patterns, not on slide examples. The course runs online or on site, lasts one day and is offered at a fixed price per participant.

The course is delivered live – either online in a virtual classroom or on-site in our training rooms in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run it exclusively for your team.

Focus areas of the course

Onboarding devicesAttack surface reductionEndpoint detection and responseAdvanced hunting with KQLAutomated investigationWorking with Intune

Who is this course for?

  • System administrators and IT operations
  • Help desk and support staff moving into administration
  • IT architects focused on Microsoft environments
  • Security officers and compliance teams

What you will be able to do

  • You know the key topics of Microsoft Defender for Endpoint – Onboarding devices, Attack surface reduction, Endpoint detection and response, Advanced hunting with KQL, Automated investigation and Working with Intune – and can apply them in practice.
  • You set up Microsoft Defender for Endpoint correctly and operate it securely.
  • You delegate permissions and enforce security requirements consistently.
  • You narrow down Microsoft Defender for Endpoint issues systematically and resolve them.
  • You automate routine tasks with PowerShell and document your configuration.

Course outline

Module 1 Concepts and architecture of Microsoft Defender for Endpoint
  • Structure, roles and components involved at a glance
  • Where Microsoft Defender for Endpoint fits into on-premises and hybrid Microsoft environments
  • Licensing and feature boundaries, as far as relevant for planning
  • Typical use cases in mid-sized and large organizations
Module 2 Focus areas: Microsoft Defender for Endpoint
  • Onboarding devices
  • Attack surface reduction
  • Endpoint detection and response
  • Advanced hunting with KQL
  • Automated investigation
  • Working with Intune
Module 3 Setup and configuration
  • Prerequisites and preparing the lab environment
  • Installing and initially configuring Microsoft Defender for Endpoint step by step
  • Permissions, delegation and administrative separation
  • Integration with directory services, DNS and networking
Module 4 Operations, security and automation
  • Handling daily administration tasks efficiently
  • Hardening according to common security recommendations
  • Automating tasks with PowerShell and templates
  • Monitoring, reports and log evaluation
Module 5 Troubleshooting and hands-on labs
  • Systematic troubleshooting with event logs and diagnostic tools
  • Reproducing and fixing typical Microsoft Defender for Endpoint issues
  • Backup, recovery and emergency procedures
  • Case studies from real administration scenarios
Module 6 Transfer to your daily work
  • Exercise based on a realistic case
  • Typical mistakes and how to avoid them
  • Checklist and templates to take away
  • Open questions, outlook and resources for further learning

Prerequisites

Basic knowledge of Windows and networking (TCP/IP, DNS) is helpful. Entry-level courses require no administration experience. Basic knowledge of the topic is helpful.

Technical requirements

Laptop with a current browser and RDP client; the lab environment for Microsoft Defender for Endpoint is provided by us.

Dates & locations

For every location we suggest a date roughly four weeks ahead. Your preferred date is always possible.

  • Munich Thu, 10 December 2026 6 hrs Request
  • Salzburg Tue, 15 December 2026 6 hrs Request
  • Berlin Fri, 11 December 2026 6 hrs Request
  • Augsburg Wed, 16 December 2026 6 hrs Request
  • Hanover Fri, 11 December 2026 6 hrs Request
  • Bremen Wed, 16 December 2026 6 hrs Request
  • Stuttgart Wed, 16 December 2026 6 hrs Request
  • Kaiserslautern Tue, 15 December 2026 6 hrs Request
  • Online Fri, 11 December 2026 6 hrs Request

Frequently asked questions

Who is the Microsoft Defender for Endpoint course suited for?

It is for administrators, support staff and architects who operate or introduce Microsoft Defender for Endpoint. Beginners learn concepts and standard tasks, while experienced teams deepen security, automation and troubleshooting. We align the focus areas in a short pre-call.

Do we work in our own environment or in a lab?

For Microsoft Defender for Endpoint we provide an isolated lab environment where you can change configurations safely and provoke failures on purpose. Your production systems stay untouched. We can discuss scenarios from your daily work conceptually as case studies.

How much does “Microsoft Defender for Endpoint” cost?

The course costs a flat €949 plus VAT per participant – whether online or on-site. This includes 6 hours of live training with a trainer, course materials, a lab environment and a certificate of attendance.

Can I suggest my own date?

Yes. For every location we suggest a date roughly four weeks ahead. In the request form you can always describe your preferred date or period in free text – we check availability and get back to you within one working day.

Is the course online or on-site?

Both are possible: live online in a virtual classroom or on-site in Munich, Salzburg, Berlin, Augsburg, Hanover, Bremen, Stuttgart and Kaiserslautern. We can also run the course exclusively for your team.

Can the course be tailored to our team?

Yes. Tailor-made courses cost approx. €4,500 more, depending on the topic and by arrangement. We agree content, examples and exercises with you in advance.

More courses in Windows Server & Microsoft Infrastructure

All 28 courses in Windows Server & Microsoft Infrastructure