A companion page for each field guide
What each guide covers, its chapter map, and a placement quiz that tells you where to start.
Microsoft Defender Field Guides
For exam SC-200
Field guideMicrosoft Defender for Endpoint Field Guide
A device can sit in inventory while its sensor never reports, and a legacy Group Policy object can outrank the Intune antivirus policy you shipped.
Field guideMicrosoft Defender XDR Field Guide
Microsoft Defender XDR turns workload signals into correlated incidents you can triage, investigate, and disrupt.
Field guideMicrosoft Sentinel Field Guide
Onboarding Microsoft Sentinel to the Defender portal can silently disable Fusion, rewrite the scope of your automation rules, and strip the incident-provider condition out of detections you already shipped.
Field guideKQL Threat Hunting Field Guide
A hunting query returns zero rows and nobody in the room can say whether the environment is genuinely clean or the table was never populated because the connector behind it was never turned on.
Microsoft Entra Field Guides
For exam SC-300
Field guideAuthentication and Conditional Access with Microsoft Entra ID
A disabled method can stay live in a legacy MFA or SSPR policy, and a policy that ships without emergency access exclusions can lock out recovery and administrators.
Field guideMicrosoft Entra ID Fundamentals Field Guide
Group licensing quietly gives a user with no usage location the tenant's location, and dynamic groups and dynamic administrative units share one 15,000 ceiling.
Field guideHybrid Identity and Global Secure Access with Microsoft Entra ID
An organizational-unit rename can silently delete synchronized objects.
Field guideIdentity Governance with Microsoft Entra ID
Access reviews can miss post-snapshot provisioning, and PIM group permissions can take up to 24 hours to apply.
Field guideWorkload Identities and App Registrations with Microsoft Entra ID
Software authentication should not depend on stored client secrets.
Microsoft Purview Field Guides
For exam SC-401
Field guideAudit, Alerts, and Investigation with Microsoft Purview
The what-happened ticket arrives with a deadline, and the event you need aged out of the audit log months ago. The investigation surface, in the order you use it.
Field guideCommunication Compliance with Microsoft Purview
Communication Compliance must monitor employee messages without becoming an undefended surveillance program.
Field guideData Loss Prevention with Microsoft Purview
Encrypting a file to protect it can hide its contents from the DLP engine you were counting on to read them.
Field guideeDiscovery and Legal Holds with Microsoft Purview
A search is not preservation. If a matter is searched before a hold is applied, data can disappear before anyone notices.
Field guideInsider Risk Management with Microsoft Purview
Rollouts fail when a configured policy produces nothing, policy health turns Unhealthy, or Adaptive Protection does not apply enforcement.
Field guideData Retention and Records Management with Microsoft Purview
A retention policy can publish cleanly while its delete action is set to purge content that still has to be kept.
Field guideSensitivity Labels and Data Classification with Microsoft Purview
Container labels get mistaken for file protection, and encryption and usage rights can lock owners out of their own files.
Microsoft Intune Field Guides
For exam MD-102
Field guideMicrosoft Intune Windows Autopilot and Deployment Field Guide
An MDM enrollment scope left at None, or a hardware-hash CSV corrupted before import, hands the user a stalled PC.
Field guideMicrosoft Intune Application Management Field Guide
Assigned software can fail to install while the admin center still reports success.
Field guideMicrosoft Intune Device Management and Enrollment Field Guide
Intune deployments fail green, not red: nothing enrolls, every device passes by default, and the admin center reads healthy the whole time.
Field guideMicrosoft Intune Endpoint Security and Updates Field Guide
Policy state is not device enforcement. A BitLocker profile can apply while encryption never starts.
Microsoft Teams Field Guides
For exam MS-700
Field guideChannels, Chats, and Apps for Microsoft Teams Administrators
A channel type cannot be converted after creation, and a deleted message remains discoverable for 21 days.
Field guideEnvironment and Security for Microsoft Teams Administrators
A compliant Teams environment depends on services beyond Teams.
Field guideGovernance, Guest Access, and Devices for Microsoft Teams Administrators
Teams governance is split across Microsoft 365 Groups, Microsoft Entra, SharePoint, and the Teams admin center.
Field guideMeetings, Webinars, and Calling for Microsoft Teams Administrators
Most Teams Phone failures are not outages. They are a prerequisite you skipped, and the portal will not tell you which one.
Field guideMonitoring and Troubleshooting for Microsoft Teams Administrators
Call quality work breaks down when the investigation starts on the wrong surface.
Microsoft 365 Administrator Field Guides
For exam MS-102
Field guideMicrosoft Entra ID Directory Synchronization Field Guide
Hybrid identity fails quietly. The run history is green, licenses assign, and a third of your users cannot sign in.
Field guideMicrosoft 365 Tenant Administration Field Guide
A license refuses to assign because UsageLocation was never set. Every control is visible somewhere; how they interact is not.
SharePoint Online Field Guides
SharePoint Online, no Microsoft exam
Field guideSharePoint Online Administration and Migration Field Guide
SharePoint Online has no servers for you to patch, which is exactly why its failures are harder to find.
Field guideSharePoint Online Content, Metadata, and Search Field Guide
The column nobody indexed. The term set left open.
Field guideSharePoint Online Governance, Security, and Compliance Field Guide
Nothing in SharePoint compliance breaks loudly.
Field guideSharePoint Online Permissions and Sharing Field Guide
You can build a textbook-correct site permission model and still watch an Anyone link walk a document out to an unauthenticated stranger.
Field guideSharePoint Online Sites and Architecture Field Guide
Clearing the self-service site creation checkbox does not stop sites from appearing. Someone spins up a Team and a site appears anyway, through a pipeline the checkbox never touched.
Every Kindle book here has a sample on its Amazon page, about the first 10 percent of the book.