This was the most frustrating applied skill to prepare for because there’s a particular frustration that comes with trying to learn a security platform tool you don't have direct access to (without a subscription). That was my experience with Microsoft Defender XDR, and I think it's worth being upfront about it. Defender XDR is Microsoft's extended detection and response platform the tool that security teams use to detect threats, investigate incidents, and respond across endpoints, email, identity, and cloud apps, all from a single console. In a Microsoft-heavy environment, which most South African enterprises run on, this is the platform you're likely to encounter on day one of a SOC role, which is why I believe that this one was the most needed to have out of the three that I've completed on my journey.
The challenge with learning Defender XDR outside of a job is access. The full feature set lives behind a Microsoft E5 licence, which isn't cheap, and the sandbox environments Microsoft provides through their learning platform are inconsistent at best. Sometimes they work. Sometimes they time out before you've finished reading the instructions. I spent more time than I'd like to admit troubleshooting environments that simply weren't cooperating.
So I had no choice but to make it work and adapt. Microsoft Learn's modules gave me the conceptual framework. YouTube filled in the visual gaps, which allowed me to see the platform in action, even through someone else's screen, and gave me a mental model of how investigations actually flow. And the Applied Skills assessment itself, which is scenario-based rather than multiple choice, forced me to apply that knowledge under conditions that at least approximated real work.
What genuinely interested me about Defender XDR was how it connects the dots. A single alert in isolation doesn't tell you much. But when you can correlate signals across email, identity, and endpoints simultaneously, the picture becomes clearer. That correlation is where the real work happens, and it's what I want to get better at.
I'm looking at this badge as a starting point, and definitely not as a destination. But it's a starting point built on more than just passing a multiple-choice test.
