Top Azure And Microsoft 365 Security Training Courses

If you want one course that teaches you to attack and defend Entra ID and Azure in a live lab and ends with a hands-on exam, start with Altered Security’s CARTP course, then move to its CARTE track. For deep identity tradecraft, Outsider Security’s Offensive Entra ID class is taught by the researcher behind much of the public work on Primary Refresh Tokens and Conditional Access. SpecterOps’ four-day Adversary Perspectives: Azure is the strongest instructor-led option for red teams starting cloud engagements.

Good Azure security training in 2026 is mostly identity training. Token theft, device code phishing, consent abuse, Conditional Access gaps, Intune and Microsoft Graph permissions are where real Microsoft 365 breaches happen, so the courses below focus there. If you are comparing broader options across AWS and Google Cloud as well, see our list of the top cloud security training providers, and for exam-led paths, our guide to the top cloud penetration testing certifications.

We checked every provider’s own site for course content, format and pricing in October 2026.

Azure And Microsoft 365 Security Training At A Glance

Provider	Headquarters	Best For	Key Course Or Cert
Altered Security	India and Singapore	Self-paced labs with a practical exam	CARTP and CARTE
Outsider Security	Netherlands	Deep Entra ID and hybrid identity attacks	Offensive Entra ID (Azure AD) and Hybrid AD Security
SpecterOps	United States	Red teams on their first cloud engagement	Adversary Perspectives: Azure
XINTRA	Online	Attack plus forensics and detection	Attacking and Defending Azure and M365
Claranet (NotSoSecure)	United Kingdom	Short practical Azure hacking class	Hacking Azure: From Recon to Domination
SANS Institute	United States	Identity engineers and defenders	SEC559
Invictus Incident Response	Rotterdam and Atlanta	Incident responders in Microsoft clouds	Advanced Cloud Incident Response in Azure and Microsoft 365
Antisyphon Training	United States	Affordable defensive hardening	Defending M365 and Azure
Microsoft Learn	Redmond, Washington	Vendor certification for admins	SC-300 and SC-500
SySS	Tübingen, Germany	In-person training in Germany	Hack12

Best Azure And Microsoft 365 Security Training Courses In 2026

1. Altered Security — Seven Live Azure Tenants And A 24-Hour Practical Exam

Altered Security, led by founder Nikhil Mittal, runs “Cloud Red Team Tactics for Attacking and Defending Azure,” the beginner course behind the CARTP (Certified by Altered Security Red Team Professional for Azure) certification. It covers recon and discovery, initial access, enumeration, privilege escalation, lateral movement, persistence, data mining, defenses and defense bypass. The lab has 26 learning objectives, 77 tasks and seven live Azure tenants, reached by browser or VPN from a cloud student VM with tools preinstalled. You get 15+ hours of video, a lab manual and kill chain diagrams.

The CARTP exam is a 24-hour hands-on test where you compromise listed resources across tenants and submit a report. Prices as listed on its site in October 2026 run $449 for 30 days of lab access, $649 for 60 days and $849 for 90 days. The advanced CARTE course goes further into FOCI tokens, Temporary Access Pass, cross-tenant access, Azure Lighthouse and Arc, Kerberos in Entra ID, and bypassing Conditional Access, MFA and PIM, with a 48-hour exam from $499.

Best for: Pentesters who want a respected azure red team certification earned in a real lab, not a multiple-choice exam.

2. Outsider Security — Primary Refresh Token And Conditional Access Bypass Training From Dirk-jan Mollema

Outsider Security is the company Dirk-jan Mollema started in 2022. He is a Microsoft Security MVP whose research on Entra ID tokens, device identities and hybrid lateral movement is cited across the industry. His “Offensive Entra ID (Azure AD) and Hybrid AD Security” course runs three days in person, with a four-day public edition in The Hague.

The syllabus is close to a map of how Microsoft 365 tenants actually get breached: roles and privileged access models, OAuth2 flows and token attacks, application abuse, agent identities, hybrid integration and lateral movement, Conditional Access policies and their bypasses, Primary Refresh Tokens and their abuse, device code and PRT phishing, Entra ID device internals and Windows Hello internals. Labs are challenge-based. The class is aimed at intermediate red teamers, penetration testers and security architects. Its site lists a public edition in The Hague on November 16 to 19, 2026, plus a February 2026 run at Insomni’hack, and most deliveries are private on-site classes for internal teams.

Best for: Experienced red teams that want entra id security training at research depth.

3. SpecterOps — Four-Day Azure And Entra ID Course On A Browser-Based Range

SpecterOps, the team behind BloodHound, teaches “Adversary Perspectives: Azure,” a four-day course on how attackers find and exploit weaknesses in Azure and Entra ID. Day one covers Entra ID, app registrations, Entra roles, Azure Resource Manager and Azure roles. Day two moves to Microsoft 365, App Services, virtual machines, Microsoft Graph, Intune and OAuth. Day three is hybrid identity and authentication (device, passwordless, OIDC and MFA), and day four covers Conditional Access, external recon, credentials, PIM and tooling.

Labs run on a SpecterOps training range in the browser, so no local VMs are needed. The course assumes no prior Azure knowledge and is pitched at red teamers starting their first cloud engagement and at defenders securing Azure. SpecterOps offers live in-person, virtual, on-demand and private formats across its catalog; pricing for this course was not listed on its page. Teams already using SpecterOps’ identity attack path work will find the approach familiar.

Best for: Red teams and defenders who want structured instructor-led coverage of Graph, Intune and Conditional Access.

4. XINTRA — Eleven Modules Pairing Each Azure Attack With Forensics And Detection

XINTRA’s “Attacking and Defending Azure and M365” is built by its founder Lina Lau (InverseCos), an incident responder and Black Hat trainer. Each technique is taught four ways: attack methodology, forensics and detection, mitigation, and an attack-and-defend demo. Its 11 modules run from reconnaissance and initial access through credential theft, lateral movement, privilege escalation, persistence and defense evasion, with log analysis in SOF-ELK.

Topics include password spraying, OAuth and device code abuse, Golden SAML, Key Vault attacks, token theft, Pass the PRT and Pass the Cookie, managed identities, Intune, Azure Arc, Lighthouse and log spoofing. As listed on its site in October 2026, the online version costs $1,550 with 365 days of access, and the live enterprise version costs $3,000 per person with a ten-person minimum. Note that the online version has no hosted labs; you use your own tenant (a free developer E5 tenant works). XINTRA says a major update is due in January 2027.

Best for: Blue teamers and DFIR staff who need to recognize Microsoft 365 attacks in logs.

5. Claranet Cyber Security — Two-Day Hacking Azure Class With 18+ Labs

Claranet’s “Hacking Azure: From Recon to Domination” sits in its NotSoSecure training line, a name long known for Black Hat classes. It is a two-day beginner to intermediate practical class with more than 18 hands-on labs and 30 days of Hack-Lab access afterward.

The Entra ID module covers authentication methods, MFA bypass, Conditional Access evasion, Identity Protection and using refresh tokens to keep persistent access to Office 365 and SharePoint. Other modules cover reconnaissance, storage SAS URLs, Azure Resource Manager services, Azure DevOps, Azure Arc and persistence. It is delivered live online or through training partners. Prices and dates are posted on Claranet’s events page rather than the course page, so check there before you plan around it.

Best for: Pentesters who need a fast, lab-heavy introduction before a client Azure test.

6. SANS Institute — SEC559 Five-Day Identity Course With 17 Labs

SANS SEC559, “Identity Security for Cloud, Hybrid, and Agentic,” is a five-day, 30-hour course centered on Microsoft Entra ID and Active Directory. Day one treats identity as the control plane: service principals, managed identities, Graph permissions and privilege paths. Day two covers authentication strength, access, refresh and primary refresh tokens, token replay, device code abuse, OAuth consent abuse and Conditional Access. Later days cover hybrid sync and federation, PIM, cross-tenant access, agent identity governance and detection, ending in a capture-the-flag on a full hybrid identity breach.

There are 17 labs in total. As listed on its site in October 2026, live sessions cost $8,260 per seat. The course is aimed at IAM engineers, SOC analysts, incident responders and Microsoft 365 admins with security duties. No GIAC certification is attached yet. For the investigation side, SANS FOR509 covers the Microsoft 365 Unified Audit Log, Graph and Entra ID sign-in logs and maps to the GCFR certification.

Best for: Organizations with SANS budgets that want defenders trained on identity attacks.

7. Invictus Incident Response — Microsoft 365 Incident Response Training From The Microsoft Extractor Suite Team

Invictus Incident Response, with offices in Rotterdam and Atlanta, is a cloud incident response firm founded by Korstiaan Stam, a former SANS FOR509 instructor. Its team maintains Microsoft Extractor Suite, a widely used open-source tool for pulling Microsoft 365 and Entra ID evidence. Stam’s “Advanced Cloud Incident Response in Azure and Microsoft 365” ran as a two-day DEF CON Training class in 2026.

The course follows the evidence each Azure attack phase leaves behind. It covers Entra ID, Conditional Access and Identity Protection logs, KQL and Graph API for investigations, Unified Audit Log analysis, inbox and transport rule abuse, token abuse and anti-forensics, then remediation, ending in a CTF. Students work in a preconfigured lab tenant. The DEF CON Las Vegas run was listed at $2,500. Invictus’ own site describes hands-on labs in real cloud environments, though its training page did not load for us, so confirm current dates directly.

Best for: Incident responders who handle business email compromise and tenant takeovers.

8. Antisyphon Training — Sixteen-Hour Defending M365 And Azure Course From $575

Antisyphon Training, the training arm associated with Black Hills Information Security, offers “Defending M365 and Azure” taught by Kevin Klingbile, who leads a penetration testing team and has over 20 years of offensive and defensive experience. It is a 16-hour course with a certificate of completion.

The syllabus is broad and practical. On the Microsoft 365 side it covers Entra ID users, groups, applications, PIM, Identity Protection, Conditional Access, MFA and SSPR, plus Intune, Exchange, Microsoft Graph, Forms, SharePoint and Teams. The Azure side covers subscriptions, Key Vault, Azure Firewall, Application Gateway, Azure DevOps, governance, Cloud Shell, compute, networking and storage. As listed on its site in October 2026, the on-demand version costs $575, and live seats at Wild West Hackin’ Fest Mile High 2027 range from $825 to $2,745.

Best for: Admins and small security teams that need microsoft 365 security training on a modest budget.

9. Microsoft Learn — SC-300 Identity Exam And The New SC-500 Replacing AZ-500

Microsoft’s own credentials are the defensive baseline many employers ask for. SC-300 (Microsoft Certified: Identity and Access Administrator Associate) tests user identities, authentication and access management, workload identities and identity governance. It is a 100-minute proctored exam, renews free each year through an online assessment, and is priced by country. Microsoft lists an English update to the exam on October 28, 2026.

One change catches many buyers: AZ-500 (Azure Security Engineer Associate) was retired on August 31, 2026. Its replacement is SC-500, Microsoft Certified: Cloud and AI Security Engineer Associate, which covers identity and governance, storage, database and network security, compute (including AI workloads) and security posture. Avoid any vendor still selling AZ-500 prep. These exams teach configuration, not attack techniques, so pair them with an offensive course above.

Best for: Administrators and engineers who need a recognized Microsoft credential.

10. SySS — Hack12 Two-Day Entra ID And Azure Attack Course In Tübingen

SySS is a German penetration testing company based in Tübingen, and its training catalog includes “Hack12: Attacks Against Entra ID and Azure Environments.” The two-day course covers Entra ID structure, permissions and roles, privilege escalation and Conditional Access, Azure infrastructure and technical accounts, Microsoft 365 services (Exchange Online, SharePoint and Teams) and cloud reconnaissance.

Prerequisites are modest: basic Windows and Linux skills and comfort on the command line. As listed on its site in October 2026, the course costs €1,596, with dates in Tübingen in April and July of 2026 and 2027. The 2026 and 2027 brochures are German only, so confirm the teaching language before you book.

Best for: German and DACH teams that want classroom training from a working pentest firm.

How To Choose The Right Azure Security Training

Do You Need Offensive Or Defensive Skills?

Pentesters and red teams should start with Altered Security, Outsider Security, SpecterOps or Claranet, since they teach token abuse and Conditional Access bypass in labs. Defenders get more from XINTRA, Invictus, SANS SEC559 or Antisyphon, which tie each attack to the logs it leaves. Most teams benefit from one of each: you cannot write good detections for attacks you have never run.

Does The Course Include A Real Tenant Or Lab?

Entra ID behavior is hard to learn from slides. Check whether labs are hosted (Altered Security, SpecterOps, Claranet, Invictus) or whether you bring your own tenant, as with XINTRA’s online version. Hosted multi-tenant labs let you practice cross-tenant and hybrid attacks you cannot safely reproduce at work. If you want more practice time after a course, our list of cyber ranges and hands-on security training platforms covers subscription labs.

Is The Content Current With Microsoft’s Changes?

Microsoft renames products and changes defaults often. Look for syllabi that say Entra ID rather than only Azure AD, and that cover recent topics such as agent identities, token protection and passwordless methods. The AZ-500 retirement is a good test: any vendor still selling it as current has not updated its catalog.

Do You Want A Certification Or Just The Skills?

Practical exams like CARTP and CARTE prove you can compromise a tenant, which matters to pentest employers. Microsoft’s SC-300 and SC-500 carry weight with corporate IT hiring managers. Conference-style classes from Outsider Security, SpecterOps and Invictus give certificates of completion but are bought mainly for the instructor’s expertise.

Frequently Asked Questions

What Is The Best Azure Red Team Certification?

Altered Security’s CARTP is the most common starting point because it combines a live multi-tenant lab with a 24-hour practical exam. Its advanced CARTE certification adds a 48-hour exam covering Conditional Access, MFA and PIM bypasses, cross-tenant access and token abuse. Both expire after three years and can be renewed.

Is AZ-500 Still Available In 2026?

No. Microsoft retired the Azure Security Engineer Associate certification, its exam and its renewal assessments on August 31, 2026. The replacement is SC-500, Microsoft Certified: Cloud and AI Security Engineer Associate, which reached general availability in July 2026 and adds security for AI workloads to the older Azure security topics.

Can I Learn Entra ID Attacks Without Hacking A Real Company Tenant?

Yes, and you should never test a tenant you do not own or have written permission to test. Courses such as CARTP, SpecterOps and Claranet provide hosted lab tenants. For self-study, Microsoft’s free developer program tenants work for practicing configuration and some attack techniques, which is the approach XINTRA’s online course uses.

Conclusion

The top Azure and Microsoft 365 security training courses in 2026 all treat identity as the core skill. For offensive work, Altered Security gives the best value per lab hour, while Outsider Security and SpecterOps add instructor depth on tokens, devices and Conditional Access. For defense, XINTRA, Invictus, SANS SEC559 and Antisyphon teach you to see those same attacks in logs, and Microsoft’s SC-300 and SC-500 cover the administrative baseline.

Pick one offensive and one defensive course, budget time in a real lab, and recheck syllabi against Microsoft’s latest changes before you buy. If your organization would rather hire testers than train them, see our list of the top cloud penetration testing companies.