Featured track: Microsoft Entra ID Security

Hands-on identity security, one lab at a time.

Build it in a lab tenant, then assess it the way a real enterprise would. Every lab ends with evidence you can show.

Start Lab 01 → Browse all labs
12Hands-on labs
3Programme phases
21hGuided lab time
P2Entra ID trial licence
How every lab works

Measure, change, prove, explain.

Each Identity Bytes lab follows the same loop, so you always know where you are and what evidence you should have at the end of it.

  1. Measure

    Baseline the current state with a script you can re-run, so every later change has a before figure.

  2. Change

    Apply the control step by step, with report-only modes and dry runs before anything is enforced.

  3. Prove

    Verify the change held, re-run the baseline and keep the output as dated evidence.

  4. Explain

    Map the result to risk, compliance and the business, in language a non-technical reader can act on.

Use a disposable tenantLabs make real directory changes. Run them against a personal, non-production tenant only, never against an environment anyone depends on.
Start here

Foundations before the labs.

Five short guides that cover the theory the labs assume. Read them in order, or jump to the one the next lab needs.

Check you are ready →
01IAM FoundationsIdentities, authentication strength, protocols, tokens and access models.About 20 min 02PAM FoundationsPrivileged accounts, the attack path, vaulting, sessions and tiering.About 20 min 03IDAM and PIMJoiner, mover, leaver governance and just-in-time admin roles.About 18 min 04Best PracticesA prioritised checklist you can tick off and copy as a status report.38 items 05Lab PrerequisitesKnowledge by lab, setup steps and an eight-question self-check.About 60 min setup
Featured track · IB-ENTRA-SEC

Entra ID Security, in three phases.

Twelve labs that take one Microsoft Entra tenant from an unmeasured baseline to a hardened, monitored and well-governed estate. Pick a phase to filter the library below.

Your progress

0of 12

Mark labs complete as you go. Progress is saved in this browser only.

Start Lab 01 →
Lab library

Every lab, ready to open.

Each lab stands on its own but builds on the one before. Filter by phase or difficulty.

Showing 12 of 12 labs

01 Assessment Identity Risk Baseline Produce a Graph PowerShell baseline covering MFA coverage, privileged roles, dormant accounts and SMS reliance. Intermediate90 minOpen lab 02 Authentication Move Off SMS Plan and validate a controlled migration from SMS to Microsoft Authenticator without locking anyone out. Intermediate75 minOpen lab 03 Conditional Access Conditional Access MFA Stage, test in report-only and then enforce MFA policies safely, with break-glass exclusions first. Advanced120 minOpen lab 04 Authentication FIDO2 and Passwordless Roll out phishing-resistant authentication methods to your highest-risk directory roles. Advanced120 minOpen lab 05 Recovery SSPR and Domain Risk Protect the account recovery path and the tenant's domain trust surface with SSPR and domain hygiene. Intermediate90 minOpen lab 06 Automation Automated Disablement Build dry-run-first automation that disables accounts that never registered MFA, with circuit breakers. Advanced120 minOpen lab 07 Privilege PIM and JIT Access Replace standing admin rights with role eligibility, approval workflows and time-bound elevation. Advanced110 minOpen lab 08 Governance Access Reviews Keep guest and privileged access accountable through recurring, evidence-producing reviews. Intermediate100 minOpen lab 09 Hybrid Hybrid Identity Hardening Protect the bridge between on-premises Active Directory and Entra ID, the most abused identity path. Advanced120 minOpen lab 10 Detection Defender Identity Protection Connect Entra risk signals to a repeatable, documented response instead of an inbox full of alerts. Intermediate100 minOpen lab 11 Automation PowerShell Reporting Turn one-off assessments into a reusable module and scheduled evidence packs for auditors. Intermediate110 minOpen lab 12 Reporting Roadmap and Secure Score Turn twelve labs of results into a prioritised, board-ready identity security roadmap. Intermediate100 minOpen lab
Before you start

What you need.

The short version is below. Lab Prerequisites has the full setup steps and a self-check.

A lab tenant

A free Microsoft Entra tenant with an Entra ID P2 trial. Labs 09 and 10 are richer with an optional on-premises lab domain.

PowerShell 7

With the Microsoft Graph SDK installed, run Install-Module Microsoft.Graph once before Lab 01.

An evidence folder

Every lab exports CSV and HTML output. Keep it dated, it becomes your before and after story.

Want the theory behind the labs? Training materials collects the Microsoft Learn pages each lab builds on, plus the SC-300 and SC-900 certification guides.Open training materials