Multi-Region Cloud Identity Architecture | Microsoft Entra ID Lab Guide

What Are We Building?

Enterprise-Scale Multi-Region Identity Architecture

☁️ Uses: Microsoft 365 Developer Program (Free) + Azure Free Tier

🌐

Global Enterprise Identity

Design and implement a multi-region Entra ID architecture that mirrors Fortune 500 identity infrastructure. Master Conditional Access, Privileged Identity Management, and hybrid identity scenarios.

Multi-Region Identity Architecture

🇪🇺

Europe Region

UK, Germany, France
GDPR Compliance

🇺🇸

Americas Region

US East, US West
SOC 2 Compliance

🇸🇬

Asia Pacific

Singapore, Sydney
Local Data Residency

🏛️

Central Governance

Global Policies
Unified Audit

🏢 Enterprise Skills You'll Master

This project teaches the exact skills used by identity architects at Fortune 500 companies:

Enterprise Requirement	What You'll Implement	Consulting Value
Multi-Tenant Design	Entra ID Tenant + Resource Groups	$150K+ projects
Conditional Access	10+ Risk-Based Policies	Zero Trust compliance
Privileged Identity Management	JIT Admin Access	SOX/PCI compliance
Hybrid Identity	Azure AD Connect Setup	M&A integration
Access Reviews	Automated Certification	Audit readiness

🎯

What You'll Have When Done

Entra ID tenant with 500+ test users
4 resource groups simulating global regions
15+ application registrations with SSO
10+ Conditional Access policies
Privileged Identity Management (PIM) for admins
Access review campaigns
Hybrid identity with simulated on-prem AD
Complete audit logging and reporting

⏱️

Time Investment

Week	Focus Area	Time
Week 1	Tenant Setup + User Provisioning	8 hours
Week 2-3	App Registrations + Conditional Access	12 hours
Week 4	Hybrid Identity + AD Connect	16 hours
Week 5-6	PIM + Access Reviews	20 hours
Week 7-8	Production Hardening + Disaster Recovery	12 hours

Total: 6-8 weeks (68 hours)

Core Concepts

Understanding Microsoft Entra ID Architecture

🧠

Master These Concepts

Microsoft Entra ID (formerly Azure AD) is the backbone of Microsoft's cloud identity platform

🏢

Tenant

Dedicated instance of Entra ID for your organization. Contains all users, groups, and apps.

👥

Directory Objects

Users, groups, service principals, devices - the entities in your identity system.

📱

App Registrations

Define how applications integrate with Entra ID for authentication.

🛡️

Conditional Access

If-then policies that control access based on signals like location, device, risk.

⚡

PIM

Privileged Identity Management - Just-in-time admin access with approval workflows.

🔄

Hybrid Identity

Connect on-premises Active Directory with cloud Entra ID.

Entra ID Authentication Flow

👤
User
Login Request

→

☁️
Entra ID
Authentication

→

🛡️
Conditional Access
Policy Check

→

📱
Application
Access Granted

💳

Licensing Tiers Explained

Tier	Key Features	Lab Access
Entra ID Free	Basic SSO, user management	✅ Always free
Entra ID P1	Conditional Access, Group-based licensing	✅ M365 Dev Program
Entra ID P2	PIM, Identity Protection, Access Reviews	✅ M365 Dev Program

💡

Free P2 License for Lab

The Microsoft 365 Developer Program gives you free E5 licenses which include Entra ID P2 - giving you access to PIM, Identity Protection, and Access Reviews!

⚠️ Enterprise Lessons Learned

Lesson	Why It Matters	Prevention
Conditional Access policies create decision paths	5+ policies can create complex interactions	Start with 2-3 policies, document interactions
Service accounts are targets	Every integration uses a service account	Rotate credentials monthly, use managed identities
Audit logging is critical	Compliance (SOX, GDPR) requires 1-year retention	Budget storage; set retention policy immediately
Group nesting creates loops	Nested groups can cause access delays	Limit nesting to 3 levels

Prerequisites

What you need before starting

📋

Checklist Before You Begin

This project uses free Microsoft resources - no credit card required!

🔑

Required Accounts (All Free)

Account	Purpose	Link
Microsoft 365 Developer Program	Free E5 licenses (includes Entra ID P2)	Join Here →
Azure Free Account	$200 credit + always-free services	Sign Up →
GitHub Account	Store scripts and configurations	Sign Up →

⚡

M365 Developer Program is Key

This program gives you a free E5 sandbox with 25 user licenses renewable every 90 days. It includes Entra ID P2 which costs $9/user/month in production!

🛠️

Tools to Install

Azure CLI - Command-line tool for Azure management
PowerShell 7+ - Required for Microsoft Graph commands
Microsoft Graph PowerShell SDK - Modern Entra ID management
VS Code - Script editing and debugging
Azure AD Connect (optional) - For hybrid identity lab

💻 Install Required Tools

# ============================================
# INSTALL REQUIRED TOOLS (Windows/PowerShell)
# ============================================

# Install Azure CLI
winget install Microsoft.AzureCLI

# Install PowerShell 7 (if not installed)
winget install Microsoft.PowerShell

# Open PowerShell 7 and install Microsoft Graph SDK
Install-Module Microsoft.Graph -Scope CurrentUser

# Install Azure AD module (legacy, but still useful)
Install-Module AzureAD -Scope CurrentUser

# Verify installations
az --version
Get-Module -ListAvailable Microsoft.Graph

📚

Recommended Knowledge

Area	Level Needed	Learning Resource
Active Directory	Basic understanding	Your existing PAM experience covers this
OAuth 2.0 / OIDC	Conceptual understanding	Project A covers this
PowerShell	Basic scripting	Microsoft Learn free courses
JSON	Read/understand	Any online tutorial

Tenant Setup

Creating your Entra ID tenant and resource structure

🎯 Goal: Create Enterprise-Like Tenant Structure

We'll set up a tenant that mirrors how Fortune 500 companies organize their cloud identity.

Join Microsoft 365 Developer Program

⏱️ 15 min

Go to developer.microsoft.com/microsoft-365/dev-program
Click Join now and sign in with your Microsoft account
Complete the setup wizard:
- Country/Region: Select your location
- Company: Enter any name (e.g., "IAM Lab Corp")
- Primary use: Learning and development
Choose Instant sandbox for pre-populated sample data
Set your admin username and password

✅

Write These Down!

Your admin account will be: admin@yourname.onmicrosoft.com
This is your Global Administrator account for the lab.

Create Azure Free Account & Link Subscription

⏱️ 20 min

Go to azure.microsoft.com/free
Sign in with your M365 Developer account (same as step 1)
Complete identity verification (phone number)
Accept terms - you get $200 credit for 30 days

⚠️

Use Same Account!

Sign into Azure with the SAME account as your M365 Developer Program. This ensures your Azure subscription is linked to the same Entra ID tenant.

Create Multi-Region Resource Groups

⏱️ 15 min

Create 4 resource groups to simulate a multi-region enterprise:

☁️ Azure CLI Commands

# ============================================
# CREATE MULTI-REGION RESOURCE GROUPS
# Simulates global enterprise structure
# ============================================

# Login to Azure CLI
az login

# Set your subscription (if you have multiple)
az account set --subscription "Azure subscription 1"

# Create Europe region resource group
az group create \
  --name "rg-identity-europe" \
  --location "uksouth" \
  --tags Environment=Lab Region=Europe Purpose=Identity

# Create Americas region resource group
az group create \
  --name "rg-identity-americas" \
  --location "eastus" \
  --tags Environment=Lab Region=Americas Purpose=Identity

# Create Asia Pacific region resource group
az group create \
  --name "rg-identity-apac" \
  --location "southeastasia" \
  --tags Environment=Lab Region=APAC Purpose=Identity

# Create Central governance resource group
az group create \
  --name "rg-identity-central" \
  --location "westeurope" \
  --tags Environment=Lab Region=Global Purpose=Governance

# Verify all groups created
az group list --output table

Configure Tenant Security Settings

⏱️ 10 min

Open entra.microsoft.com
Navigate to: Identity → Overview → Properties
Note your Tenant ID - you'll need this for scripts
Navigate to: Identity → Users → User settings

Configure these security settings:

Users can register applications	No
Restrict non-admin users from creating tenants	Yes
Users can consent to apps	No

Users & Groups

Creating 500+ test users with PowerShell automation

👥

Enterprise-Scale User Provisioning

Automate the creation of realistic test users across multiple departments and regions

Connect to Microsoft Graph

⏱️ 5 min

🔌 Connect PowerShell to Graph API

# ============================================
# CONNECT TO MICROSOFT GRAPH
# Required for user and group management
# ============================================

# Import the Microsoft Graph module
Import-Module Microsoft.Graph

# Connect with required scopes
Connect-MgGraph -Scopes @(
    "User.ReadWrite.All",
    "Group.ReadWrite.All",
    "Directory.ReadWrite.All",
    "RoleManagement.ReadWrite.Directory"
)

# Verify connection
Get-MgContext

# Should show your tenant and account info

Create Department & Region Groups

⏱️ 10 min

📁 Create Security Groups

# ============================================
# CREATE DEPARTMENT GROUPS
# Mirrors enterprise organizational structure
# ============================================

# Define departments
$departments = @(
    @{Name="SG-IT-Admins"; Desc="IT Administrators"},
    @{Name="SG-IT-HelpDesk"; Desc="IT Help Desk Staff"},
    @{Name="SG-Engineering"; Desc="Software Engineers"},
    @{Name="SG-Finance"; Desc="Finance Department"},
    @{Name="SG-HR"; Desc="Human Resources"},
    @{Name="SG-Sales"; Desc="Sales Team"},
    @{Name="SG-Executives"; Desc="Executive Leadership"}
)

# Create each department group
foreach ($dept in $departments) {
    $params = @{
        DisplayName = $dept.Name
        Description = $dept.Desc
        MailEnabled = $false
        MailNickname = $dept.Name.ToLower()
        SecurityEnabled = $true
    }
    New-MgGroup @params
    Write-Host "Created group: $($dept.Name)"
}

# Create region groups
$regions = @("SG-Region-Europe", "SG-Region-Americas", "SG-Region-APAC")
foreach ($region in $regions) {
    New-MgGroup -DisplayName $region `
        -MailEnabled:$false `
        -MailNickname $region.ToLower() `
        -SecurityEnabled
}

Create 500 Test Users (Automated)

⏱️ 30 min

👤 Bulk User Creation Script

# ============================================
# BULK CREATE 500 TEST USERS
# Creates realistic users across departments
# ============================================

# Get your tenant domain
$tenantDomain = (Get-MgOrganization).VerifiedDomains | 
    Where-Object {$_.IsDefault} | 
    Select-Object -ExpandProperty Name

# Sample first and last names
$firstNames = @("James","Mary","John","Patricia","Robert","Jennifer","Michael","Linda","David","Elizabeth","William","Barbara","Richard","Susan","Joseph","Jessica","Thomas","Sarah","Charles","Karen")
$lastNames = @("Smith","Johnson","Williams","Brown","Jones","Garcia","Miller","Davis","Rodriguez","Martinez","Hernandez","Lopez","Gonzalez","Wilson","Anderson")

# Department distribution (weighted)
$deptWeights = @{
    "Engineering" = 150
    "Sales" = 100
    "Finance" = 75
    "HR" = 50
    "IT" = 100
    "Executives" = 25
}

# Default password for test users
$passwordProfile = @{
    Password = "TestP@ssw0rd123!"
    ForceChangePasswordNextSignIn = $true
}

# Create users
$userCount = 0
foreach ($dept in $deptWeights.Keys) {
    for ($i = 1; $i -le $deptWeights[$dept]; $i++) {
        $firstName = $firstNames | Get-Random
        $lastName = $lastNames | Get-Random
        $upn = "$firstName.$lastName$i@$tenantDomain"
        
        $userParams = @{
            DisplayName = "$firstName $lastName"
            UserPrincipalName = $upn
            MailNickname = "$firstName$lastName$i"
            AccountEnabled = $true
            PasswordProfile = $passwordProfile
            Department = $dept
            JobTitle = "$dept Specialist"
            UsageLocation = "US"
        }
        
        try {
            New-MgUser @userParams
            $userCount++
            Write-Progress -Activity "Creating Users" -Status "$userCount / 500"
        } catch {
            Write-Warning "Failed: $upn"
        }
    }
}

Write-Host "Created $userCount users!" -ForegroundColor Green

💡

Why 500 Users?

This scale lets you test: bulk operations, group dynamics, license management, and conditional access at near-enterprise levels. Single-digit users won't reveal scaling issues.

Conditional Access Policies

Implementing Zero Trust access controls

🛡️

Zero Trust Access Control

Conditional Access is the foundation of Microsoft's Zero Trust model - never trust, always verify

Recommended Policy Matrix

🔴

Block Legacy Auth

Block all legacy authentication protocols (IMAP, POP3, SMTP). Critical security baseline.

🔴

Require MFA for Admins

All users with admin roles must use MFA. No exceptions.

🔴

Block High-Risk Sign-ins

Automatically block sign-ins detected as high risk by Identity Protection.

🟡

Require MFA for All Users

All users must complete MFA when accessing cloud apps.

🟡

Require Compliant Device

Access from corporate apps requires Intune-compliant device.

🟡

Geo-Block Foreign Access

Block access from countries where company has no presence.

🟢

Session Timeout

Limit browser sessions to 8 hours for sensitive apps.

🟢

Require acceptance of terms before accessing HR apps.

Create: Block Legacy Authentication

⏱️ 10 min

Open entra.microsoft.com
Navigate to: Protection → Conditional Access → Policies
Click + New policy

Configure:

Name	CA001: Block Legacy Authentication
Users	All users
Cloud apps	All cloud apps
Conditions → Client apps	☑️ Legacy authentication clients
Grant	Block access
Enable policy	Report-only (first), then On

⚠️

Always Start with Report-Only

Enable new policies in "Report-only" mode first. Check sign-in logs for 24-48 hours before enabling. This prevents accidentally locking out users!

Create: Require MFA for All Users

⏱️ 10 min

🔐 MFA Policy Configuration

Name	CA002: Require MFA - All Users
Users	All users Exclude: Break-glass accounts
Cloud apps	All cloud apps
Conditions	None (apply always)
Grant	Require multi-factor authentication

Create: Block Foreign Access

⏱️ 15 min

First, create a Named Location for allowed countries:

Navigate to: Protection → Conditional Access → Named locations
Click + Countries location
Name: Allowed Countries
Select countries where your company operates

Create the policy:

Name	CA003: Block Foreign Access
Users	All users
Cloud apps	All cloud apps
Conditions → Locations	Exclude: Allowed Countries
Grant	Block access

Privileged Identity Management

Just-in-time admin access with approval workflows

⚡

Zero Standing Privileges

PIM eliminates permanent admin access. Users activate roles on-demand with time limits and approval.

PIM Activation Flow

👤
IT Admin
Needs Access

→

📋
Request
Justification

→

✅
Approval
Manager

→

🔓
Active
4 hours max

Enable PIM for Global Administrator Role

⏱️ 15 min

Navigate to: Identity Governance → Privileged Identity Management
Click Microsoft Entra roles
Click Roles and find Global Administrator

Click Settings and configure:

Maximum activation duration	4 hours
Require justification	Yes
Require approval	Yes
Require MFA	Yes
Send notification on activation	Yes

Add Eligible Role Assignments

⏱️ 10 min

On the Global Administrator role, click + Add assignments
Assignment type: Eligible
Select users from your IT-Admins group
Set assignment duration (e.g., 1 year)

🏢

Enterprise Best Practice

Eligible means users CAN activate the role when needed.
Active means the role is always on (avoid for privileged roles).
All admin roles should be Eligible only with 4-hour maximum activation.

Test Role Activation

⏱️ 10 min

Sign in as a user with eligible assignment
Go to: My roles in the Entra portal
Click Activate on Global Administrator
Enter justification: "Testing PIM activation for lab project"
Complete MFA if prompted
Role activates after approval (if configured)

Hybrid Identity

Connecting on-premises AD with Entra ID

🔄

Bridge On-Premises & Cloud

Azure AD Connect synchronizes your on-premises Active Directory with Entra ID

💡

Integrate with Project I

If you completed Project I (Hybrid Identity SSO Bridge with Samba AD), you can connect that environment to this Entra ID tenant using Azure AD Connect!

🔌

Azure AD Connect Sync Options

Method	How It Works	When to Use
Password Hash Sync (PHS)	Hash of password copied to cloud	Simplest option, works if on-prem AD is down
Pass-Through Auth (PTA)	Cloud validates against on-prem AD live	Security requirement: passwords never leave on-prem
Federation (AD FS)	On-prem AD FS issues tokens	Complex enterprise requirements, smart cards

Hybrid Identity Requirements

⏱️ Reference

On-premises AD Domain Controller (Windows Server or Samba)
Server for Azure AD Connect (Windows Server 2016+)
Entra ID Global Admin account
On-premises AD Enterprise Admin account
Network connectivity between on-prem and Azure

Install Azure AD Connect

⏱️ 45 min

Download Azure AD Connect from Microsoft Download Center
Run the installer on a Windows Server domain-joined to your AD
Choose Express Settings for lab (or Customize for production)
Enter your Entra ID Global Admin credentials
Enter your on-premises AD Enterprise Admin credentials
Select sync method: Password Hash Sync (recommended for lab)
Complete the wizard and start synchronization

⚠️

First Sync Takes Time

Initial sync can take 30 minutes to several hours depending on user count. Subsequent delta syncs occur every 30 minutes.

Testing & Validation

Verify your enterprise identity architecture

🧪

Comprehensive Testing

Validate each component of your multi-region identity architecture

✅

Validation Checklist

Users can sign in with MFA
Legacy auth is blocked (test with Outlook 2010 or IMAP)
Foreign IP access is blocked (use VPN to test)
PIM role activation works with justification
Access reviews can be created and completed
Sign-in logs show detailed information
Audit logs capture admin activities
Hybrid users can sync from on-prem AD

🎓

Skills Acquired

Multi-Tenant Design: Enterprise Entra ID architecture
Conditional Access: Zero Trust policy implementation
PIM: Just-in-time privileged access management
Identity Protection: Risk-based access controls
Hybrid Identity: Azure AD Connect synchronization
PowerShell Automation: Microsoft Graph API scripting
Compliance: SOX, GDPR, PCI audit readiness

💼 Consulting Opportunity

After completing this project, you can implement similar architectures for clients:

Service	Typical Engagement
Entra ID Assessment & Roadmap	$15K - $30K
Conditional Access Implementation	$25K - $50K
PIM Deployment & Training	$20K - $40K
Hybrid Identity Migration	$50K - $150K

🚀

Next Steps

Enable Identity Protection risk policies
Configure automatic access reviews
Implement Entitlement Management (access packages)
Set up Cross-tenant access for B2B collaboration
Integrate with Microsoft Sentinel for SIEM