Learn by doing
Each mat turns a big security domain into small, ordered moves. You answer questions, earn belts, and build up a mental model of the tenant one control at a time.
Microsoft gives you the controls and a policy screen that assumes you already know kung fu. The dojo doesn't. Eight mats, each one a real part of your tenant — every control comes with the attack it stops, the MITRE ATT&CK technique behind it, the exact clicks, and the script to build it. Answer a few questions about your environment and it tells you honestly what isn't for you.
Free, no sign-up, nothing to install. Your progress is saved in this browser only — nothing about your tenant leaves your machine.
Why the Dojo exists
The Dojo is a fun, hands-on way to explore the security controls hiding in plain sight across Microsoft 365, Entra ID and Defender. It is for people who want to understand what good looks like before they start changing production settings: what a control does, which attack it helps stop, where it lives, and when it may not apply to their environment.
See the why
The controls are tied back to real attacker behaviour, MITRE ATT&CK techniques, Microsoft guidance and practical deployment notes, so the setting is never separated from the risk it is meant to reduce.
Build confidence
Treat it as a training mat and planning aid. The Dojo helps security teams, admins and curious learners spot gaps, ask better questions, and prepare safer changes before anything touches a live tenant.
Pick a mat
They're independent — start anywhere. Your answers about your environment carry across all eight, so you only describe your tenant once.
How the dojo works
Belts, not a wall of settings
Each dojo is six belts, white through black. White is the stuff that's wide open right now; black is the work you do once the basics hold. You earn a belt by finishing the one before it — because that's the order that actually works.
It tells you when something isn't for you
Answer a few questions and the dojo filters itself to what you actually run. No Intune? The device policies say so and stop scoring against you. On Business Premium for some users and E5 for others? You'll be told exactly which controls need a licence you don't have, rather than being sold one.
You walk out with a plan
Every dojo exports a deployment plan in Markdown and a script — Graph JSON, PowerShell, DNS records — for the controls in scope for your tenant. Reads are ready to run. Writes are left for you to run deliberately.