MODULE 1
Authority Moves Through Identities and Tokens
Understand human, workload, federated, and delegated identities through the lifecycle of the authority they use.
FREE COURSE / SELF-PACED LEARNING
Cloud, Identity, SaaS, and Business Workflow Detection
Study tokens, cloud authority, SaaS evidence and business-workflow abuse in this free detection engineering course.
Read freely. Create an account to save your completed lessons.
- Experience level
- Advanced
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 9 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Trace delegated authority through identities, tokens and SaaS application permissions.
- Explain provider visibility limits when investigating a high-impact business request.
Is this the right course for you?
Who it’s for
Analysts investigating cloud identities, SaaS applications and high-impact business requests.
Scope and boundaries
Detection reasoning across identity and provider boundaries. It complements identity foundations and does not teach full tenant administration.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Follow authority through tokens, control planes, SaaS applications, messages, sharing, and business decisions where a stable host perimeter no longer explains the risk. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
The password changed but application access continued
A user resets their password after a suspicious session. A later audit record shows an application reading project files through a separately granted permission.
Your task
Identify the two access paths and the evidence needed before claiming that account recovery removed all access.
Compare your reasoning
A password reset concerns the user's credential path; the application grant is a separate authority that may remain usable. Preserve the relevant grant, app identity and resource-access records, and request authorized verification of their current state. Do not equate a recovered login with removal of every session, application permission or sharing route.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
SaaS Evidence Has Provider Boundaries
Reason about email and collaboration evidence without assuming that one provider log is complete or self-explanatory.
MODULE 3
Protect the Business Decision, Not Just the Inbox
Connect communication and identity evidence to payment, payroll, procurement, legal, and recovery decisions without pretending language reveals intent.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.