Featured track: Microsoft Entra ID Security

Hands-on identity security, one lab at a time.

Build it in a lab tenant, then assess it the way a real enterprise would. Every lab ends with evidence you can show.

Start Lab 01 → Browse all labs
21Hands-on labs
5Learning paths
34hGuided lab time
FreeNo account needed
Learning paths

Pick a goal, follow the steps.

Each path puts the right guides and labs in order, from first principles to evidence you can show. Tick steps off as you go.

See all paths →
Beginner pathIdentity Security StarterNew to identity security? Learn the ideas, set up a tenant and complete your first five labs.7 steps5 labsAbout 8 hoursStart this path →Intermediate pathEntra ID Security EngineerThe full twelve lab track: authenticate, govern privilege, then detect and report.15 steps12 labsAbout 22 hoursStart this path →Intermediate pathPrivileged Access DefenderProtect the accounts attackers want most, across Linux, Active Directory and Entra ID.7 steps5 labsAbout 8 hoursStart this path →Advanced pathActive Directory HardeningClose the classic attack routes in an on-premises domain, one lab at a time.6 steps5 labsAbout 9 hoursStart this path →Intermediate pathIdentity Threat DetectionHunt in sign-in logs, govern applications and turn findings into reports.6 steps5 labsAbout 8 hoursStart this path →
How every lab works

Measure, change, prove, explain.

Each Identity Bytes lab follows the same loop, so you always know where you are and what evidence you should have at the end of it.

  1. Measure

    Baseline the current state with a script you can re-run, so every later change has a before figure.

  2. Change

    Apply the control step by step, with report-only modes and dry runs before anything is enforced.

  3. Prove

    Verify the change held, re-run the baseline and keep the output as dated evidence.

  4. Explain

    Map the result to risk, compliance and the business, in language a non-technical reader can act on.

Use a disposable tenantLabs make real directory changes. Run them against a personal, non-production tenant only, never against an environment anyone depends on.
Start here

Foundations before the labs.

Five short guides that cover the theory the labs assume. Read them in order, or jump to the one the next lab needs.

Check you are ready →
01IAM FoundationsIdentities, authentication strength, protocols, tokens and access models.About 20 min 02PAM FoundationsPrivileged accounts, the attack path, vaulting, sessions and tiering.About 20 min 03IDAM and PIMJoiner, mover, leaver governance and just-in-time admin roles.About 18 min 04Best PracticesA prioritised checklist you can tick off and copy as a status report.38 items 05Lab PrerequisitesKnowledge by lab, setup steps and an eight-question self-check.About 60 min setup
Meet the crew

Six droplets, one tenant to protect.

Each guide on Identity Bytes has a crew member looking after it. Say hello, then follow them to their part of the site.

Lockie Shieldsworth, the Identity Bytes vault keeper Vault keeper Lockie Shieldsworth Guards the privileged accounts. If it has admin rights, Lockie wants it vaulted, rotated and watched. PAM Foundations → DJ Passkey, the Identity Bytes signal spinner Signal spinner DJ Passkey Headphones on, ear to the wire. Spins the latest security headlines and drops a passkey on every sign-in. Security news → Minty McKeycloud, the Identity Bytes cloud identity whiz Cloud identity whiz Minty McKeycloud Holds the golden key to the cloud. Knows every identity, token and protocol by name. IAM Foundations → Sparky Policypants, the Identity Bytes rulebook rocker Rulebook rocker Sparky Policypants Wired for policy. Carries the checklist everywhere and glows a little brighter with every control ticked off. Best Practices → Sunny Syncwell, the Identity Bytes lifecycle launcher Lifecycle launcher Sunny Syncwell Joiners in, movers sorted, leavers out. Keeps identities in sync and lifts admin rights only when they are needed. IDAM and PIM → Professor Bluekey, the Identity Bytes lab mentor Lab mentor Professor Bluekey Peers over the glasses and asks the useful question first: are you ready for this lab? Then hands you the key. Lab Prerequisites →
Featured track · IB-ENTRA-SEC

Entra ID Security, in three phases.

Twelve labs that take one Microsoft Entra tenant from an unmeasured baseline to a hardened, monitored and well-governed estate. Pick a phase to filter the library below.

Your progress

0of 12

Mark labs complete as you go. Progress is saved in this browser only.

Start Lab 01 →
Lab library

Every lab, ready to open.

Each lab stands on its own but builds on the one before. Filter by phase or difficulty.

Showing 12 of 12 labs

01 Assessment Identity Risk Baseline Produce a Graph PowerShell baseline covering MFA coverage, privileged roles, dormant accounts and SMS reliance. Intermediate90 minOpen lab 02 Authentication Move Off SMS Plan and validate a controlled migration from SMS to Microsoft Authenticator without locking anyone out. Intermediate75 minOpen lab 03 Conditional Access Conditional Access MFA Stage, test in report-only and then enforce MFA policies safely, with break-glass exclusions first. Advanced120 minOpen lab 04 Authentication FIDO2 and Passwordless Roll out phishing-resistant authentication methods to your highest-risk directory roles. Advanced120 minOpen lab 05 Recovery SSPR and Domain Risk Protect the account recovery path and the tenant's domain trust surface with SSPR and domain hygiene. Intermediate90 minOpen lab 06 Automation Automated Disablement Build dry-run-first automation that disables accounts that never registered MFA, with circuit breakers. Advanced120 minOpen lab 07 Privilege PIM and JIT Access Replace standing admin rights with role eligibility, approval workflows and time-bound elevation. Advanced110 minOpen lab 08 Governance Access Reviews Keep guest and privileged access accountable through recurring, evidence-producing reviews. Intermediate100 minOpen lab 09 Hybrid Hybrid Identity Hardening Protect the bridge between on-premises Active Directory and Entra ID, the most abused identity path. Advanced120 minOpen lab 10 Detection Defender Identity Protection Connect Entra risk signals to a repeatable, documented response instead of an inbox full of alerts. Intermediate100 minOpen lab 11 Automation PowerShell Reporting Turn one-off assessments into a reusable module and scheduled evidence packs for auditors. Intermediate110 minOpen lab 12 Reporting Roadmap and Secure Score Turn twelve labs of results into a prioritised, board-ready identity security roadmap. Intermediate100 minOpen lab
New in the library

Latest labs.

Recently published labs across Entra ID, Active Directory, privileged access and detection.

Open the full library →
9 November 2026 Active Directory Build a Tiered Admin Model in Active Directory Build a three tier admin model in Active Directory with separate admin accounts, an OU structure and Group Policy logon restrictions, then test that it holds. Advanced120 minOpen lab 8 November 2026 Active Directory Deploy Windows LAPS for Local Administrator Passwords Deploy Windows LAPS in Active Directory: extend the schema, set permissions, configure Group Policy, retrieve a password and prove that it rotates. Intermediate90 minOpen lab 7 November 2026 Active Directory Find Kerberoastable Service Accounts and Move Them to gMSA Find Kerberoastable service accounts in Active Directory with PowerShell, rank them by risk, then replace one with a group Managed Service Account (gMSA). Intermediate100 minOpen lab 6 November 2026 Active Directory Audit Privileged Groups and AdminSDHolder in Active Directory Use PowerShell to list every member of Domain Admins and other privileged AD groups, find stale admins and orphaned adminCount accounts, and clean them up. Intermediate75 minOpen lab 5 November 2026 Entra ID Lock Down App Consent and Review OAuth Grants in Entra ID Stop consent phishing in Entra ID: restrict user consent, turn on the admin consent workflow and audit existing OAuth permission grants with Graph PowerShell. Intermediate80 minOpen lab 5 November 2026 Entra ID Audit App Registration Secrets and Certificates in Entra ID Use Microsoft Graph PowerShell to find expired, long-lived and ownerless app registration secrets in Entra ID, then fix them and set a lifetime policy. Intermediate90 minOpen lab
DJ PasskeySecurity news · DJ Passkey on the decks

What is happening now.

Headlines from trusted security sources, updated automatically every hour.

All news →
BleepingComputer CISA flags Cisco BroadWorks flaw as actively exploited in attacks 2 h ago BleepingComputer Microsoft fixes Exchange sign-ins broken by Windows Server updates 3 h ago The Hacker News Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes 4 h ago The Hacker News Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges 5 h ago The Hacker News Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons 5 h ago The Hacker News Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches 7 h ago
Build your own lab site

Hosting and a domain for your next project.

Publish your lab notes, a portfolio or a blog of your own. This site runs on Hostinger, and you can get web hosting and a domain name in one place.

  • Web hostingPHP sites like this one, WordPress or plain HTML
  • Domain namesRegister a .com, .co.uk or other domain
  • SSL includedHTTPS for your site, set up from hPanel
Get hosting and a domain → Referral link. If you sign up, Identity Bytes may earn a commission at no extra cost to you.
Sunny Syncwell launching a site to the cloud
Sunny Syncwell, ready to launch
Before you start

What you need.

The short version is below. Lab Prerequisites has the full setup steps and a self-check.

A lab tenant

A free Microsoft Entra tenant with an Entra ID P2 trial. Labs 09 and 10 are richer with an optional on-premises lab domain.

PowerShell 7

With the Microsoft Graph SDK installed, run Install-Module Microsoft.Graph once before Lab 01.

An evidence folder

Every lab exports CSV and HTML output. Keep it dated, it becomes your before and after story.

Professor BluekeyWant the theory behind the labs? Training materials collects the Microsoft Learn pages each lab builds on, plus the SC-300 and SC-900 certification guides.Open training materials