After this day you can set up Microsoft Sentinel yourself: you create the workspace, install suitable content hub solutions, connect Microsoft services and Windows hosts, build analytics rules and automate recurring responses to incidents. Unlike a broad SOC analyst course, this day focuses only on building Sentinel. It suits security analysts and administrators who are starting a Sentinel deployment or want to tidy up an existing one.
What you’ll take away.
- Create and configure a Microsoft Sentinel workspace
- Deploy content hub solutions and connect Microsoft services
- Connect Windows hosts and their security events to Sentinel
- Create analytics rules that turn events into incidents
- Set up automation rules and playbooks for recurring responses
Your training in detail
- Who is it for?
- Security analysts, SOC staff and administrators who are setting up Microsoft Sentinel for the first time or want to tidy up an existing deployment.
- Prerequisites
- You know the Azure portal and the basics of Log Analytics, Windows event logs and security incidents. Some KQL knowledge helps.
- Format & planning
- Standard length: 1 training day. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Sentinel architecture, cost drivers and workspace planning
Creating the workspace and assigning roles and permissions
Content hub: choosing and installing solutions and enabling data connectors
Bringing in Windows security events with the Azure Monitor Agent and data collection rules
Using scheduled analytics rules and templates to create incidents
Automation rules and playbooks with Logic Apps
You connect a Windows test server to Sentinel, write an analytics rule for repeated failed sign-ins and have new incidents assigned and annotated automatically.
Exams, licences & credentials
The course follows Microsoft course SC-5001 and has no exam. Microsoft retired the related Applied Skills assessment on 30 April 2025. For a security operations certification, exam SC-200 is the relevant option. This is not an official Microsoft course unless the offer states otherwise.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
How does this differ from SC-200?
SC-200 covers the whole Security Operations Analyst role over several days. SC-5001 spends one day on setting up Sentinel.
Do I need my own Azure subscription?
The exercises need a lab environment. Whether one is provided is stated in the specific offer.
Does SC-5001 Configure SIEM security operations using Microsoft Sentinel: setting up Sentinel in a day include a certificate?
The course follows Microsoft course SC-5001 and has no exam. Microsoft retired the related Applied Skills assessment on 30 April 2025. For a security operations certification, exam SC-200 is the relevant option. This is not an official Microsoft course unless the offer states otherwise.