Track 016 labs
Start here
IAM Foundations
Vocabulary, identity lifecycle, access models and the reference architecture every later lab assumes.
Seventy-one hands-on labs across ten tracks — from your first LDAP directory to OAuth 2.1 hardening, cloud federation, zero trust and executive reporting. Practised end to end in disposable tenants and containers you control.
# Baseline identity risk before you change a thing Connect-MgGraph -Scopes "AuditLog.Read.All" $risk = Get-MgReportAuthMethods ` | Where-Object { $_.MfaCapable -eq $false } ✓ 4,812 users measured ✓ 137 admins without strong MFA ✓ evidence written to baseline.csv
Each track is a self-contained syllabus that opens with foundations and ends with reporting. Follow the order for a career-shaped path, or jump to the discipline you need this quarter.
Vocabulary, identity lifecycle, access models and the reference architecture every later lab assumes.
Measure, harden and report on a Microsoft Entra tenant — from identity risk baseline to Secure Score and executive roadmap.
OpenLDAP, Keycloak, SAML, OIDC, SCIM, JWT/JWS/JWE, OAuth 2.1 hardening, token exchange and OPA/Rego policy.
Zero-trust SSO, enterprise SAML federation, conditional access and hybrid identity bridging patterns.
HashiCorp Vault JIT, SSH key and certificate discipline, bastion patterns and PIM. Vendor-neutral PAM tradecraft.
Teleport-based zero-trust network access and end-to-end zero-trust identity architecture.
AWS IAM, Organizations & Control Tower, Identity Center, GCP IAM, Kubernetes RBAC, multi-cloud federation, AZ-104.
Entra enterprise, governance, multi-region, Sentinel identity security and Microsoft security labs.
Access reviews, joiner-mover-leaver automation and identity governance across systems.
Grafana identity dashboards and Wazuh SIEM for identity detections that survive an audit.
Certificates prove you sat an exam. Identity Bytes proves you can do the work. Every lab drops you into a realistic scenario — a mid-sized firm, a failing audit, a risky migration — and walks you through assessment, hardening, verification and reporting, exactly the way a real engagement runs.
Every lab runs the same loop so the skill sticks: prepare the environment, do the work, prove it worked, then explain the risk it reduced.
Stand up a disposable tenant or container and note exactly what you will change and how to reverse it.
Run the hands-on steps — real commands, real portals, real config — with expected results called out.
Capture verification evidence so you can show the control works, not just claim it does.
Write one sentence on the risk each control reduces — the skill that gets you hired and promoted.
Short answers to what learners ask most. For a full explainer on any topic, open that track's knowledge base article.
Identity Bytes is a hands-on training platform for identity and access management. It provides 71 practical labs across ten tracks — IAM foundations, Entra ID security, identity standards (OAuth 2.1, OIDC, SAML, SCIM, JWT, OPA), SSO and federation, privileged access, zero-trust network access, cloud and Kubernetes identity, governance and lifecycle, and observability and SIEM.
No. The IAM Foundations track assumes zero prior experience and defines every term before it is used. Each lab states its prerequisites, and the recommended path builds from vocabulary and reference architecture up to advanced protocol and cloud identity work.
Never run a lab against an employer or client environment. Every lab is designed for a personal, disposable Entra tenant or a throw-away lab VM or container. Labs include cleanup steps and ask you to record how to reverse each change before you make it.
The Identity Standards track covers OpenLDAP directories, Keycloak realms, SAML 2.0 federation, OpenID Connect with PKCE, SCIM 2.0 provisioning, JWT/JWS/JWE token internals, OAuth 2.1 hardening with DPoP and PAR, RFC 8693 token exchange, session management, RBAC-to-ABAC migration, and Open Policy Agent (OPA) with Rego.
The Cloud & Kubernetes Identity track covers AWS IAM, AWS Organizations and Control Tower, AWS IAM Identity Center, Google Cloud IAM, Kubernetes RBAC, multi-cloud OIDC workload identity federation, and Azure identity aligned to AZ-104.
The Privileged Access track is deliberately vendor-neutral. It teaches just-in-time credentials with HashiCorp Vault, SSH key and certificate discipline, bastion patterns, and privileged identity management concepts — eligibility, approval workflows, access reviews — that transfer to any PAM product.
RBAC (role-based access control) grants permissions through roles, which is simple but can cause role explosion. ABAC (attribute-based access control) decides from attributes of the user, resource, action and environment for fine-grained, context-aware policy. Lab 13 walks through migrating RBAC to ABAC without a rewrite.
Each track has an FAQ article that explains the concepts behind its labs in plain language, targeting the questions practitioners actually search for. They double as study notes and as keyword-focused, structured content that search engines can index with FAQ rich results.
Start with the flagship Entra ID Security track, or open the knowledge base and read your way in. Either way, you finish able to do the work — and prove it.