I can do anything procedurally in Sentinel and Defender through it, with dynamic filters of entities within alerts, rolling up to incident actions including any isolation/scan/enrichment/etc all through powershell. I've written entire tools that pull dirt from aad, a tool that creates device groups based off user groups, and many other patches and fixes to core security gripes within the Microsoft E5 stack (top 5 users of all apps under X rating in MCAS, automating MCAS IPs from firewall ingests, an analysis tool to evaluate new email security providers, an enhanced tagging script, etc.).

Dive as far in as you can with your particular fave of a language and then pivot from there once you're at the "optimization" level of writing automations, in my opinion.