Microsoft offer a sandbox for developers. This comes with 90 day E5 licences for testing and development purposes

https://developer.microsoft.com/en-us/microsoft-365/dev-program

You can also create an evaluation environment for their security products

https://docs.microsoft.com/en-us/microsoft-365/security/defender/eval-create-eval-environment?view=o365-worldwide

Microsoft Lab for setting up Defender to detect reconnaissance and lateral movement

https://docs.microsoft.com/en-us/defender-for-identity/playbook-lab-overview

This is the resource page for Exam SC-200: Microsoft Security Operations Analyst. The exam itself is not free however the self taught training materials for the exam are free.

https://docs.microsoft.com/en-us/learn/certifications/exams/sc-200

Becoming a Security Engineer

https://docs.microsoft.com/en-us/learn/roles/security-engineer

Every Windows command

https://www.microsoft.com/en-us/download/details.aspx?id=56846

Windows API calls

https://docs.microsoft.com/en-us/windows/win32/apiindex/windows-api-list

Microsoft's security documentation

https://docs.microsoft.com/en-us/security/

The file attachments blocked by Outlook.

https://support.microsoft.com/en-us/office/blocked-attachments-in-outlook-434752e1-02d3-4e90-9124-8b81e49a8519

A tour through some of the security internals of Windows from Steve Syfuhs

https://syfuhs.net/a-bit-about-the-local-security-authority

https://syfuhs.net/how-windows-defender-credential-guard-works

https://syfuhs.net/how-authentication-works-when-you-use-remote-desktop

https://syfuhs.net/what-happens-when-you-type-your-password-into-windows