SC-200 Training in Morocco

The SC-200 exam leads to the Microsoft Certified: Security Operations Analyst Associate certification. It validates your ability to protect a Microsoft environment by detecting, investigating and remediating threats with Microsoft Defender XDR (Defender for Endpoint, for Office 365, for Identity, for Cloud Apps), Microsoft Defender for Cloud and the Microsoft Sentinel SIEM/SOAR. KQL (Kusto Query Language) sits at the heart of the exam: threat hunting, analytics rules and workbooks all rely on it.

In Morocco, many organisations already run Microsoft 365 and Azure, and their E5 or Defender licences are often under-used for lack of trained analysts. Banks, insurers, telecom operators, public bodies and MSSPs building SOCs in Casablanca and Rabat want people who can get the most out of Sentinel and Defender XDR to cut detection time. Law 05-20 on cybersecurity, which requires in-scope entities to report incidents to the DGSSI, together with Law 09-08 and CNDP obligations on personal data, make this detection and response capability essential.

Our 4-day (28-hour) course follows the four official SC-200 domains with labs in a demo tenant: Sentinel data connectors, analytics rules, playbooks, incident investigation in the Defender portal and plenty of KQL exercises. It runs in class in Casablanca or Rabat, or as a live virtual classroom, and the exam voucher is included in the price.