Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity provider and directory. It authenticates users and workloads, issues tokens to applications, and enforces access policy through features like Conditional Access, Privileged Identity Management and Identity Protection. It is the identity control plane for Microsoft 365 and Azure, and a common IdP for third-party SaaS.

You cannot prove improvement, or justify a change to auditors and change control, without a measured starting point. A baseline captures MFA registration, privileged role membership, dormant accounts, guest accounts and SMS reliance as read-only evidence. Lab 01 produces this with Microsoft Graph PowerShell so every later hardening step has a before-and-after number.

Conditional Access is Entra's policy engine: it evaluates signals — user, group, application, device state, location, and sign-in risk — and decides whether to allow, block, or require additional proof such as MFA. Policies should be staged in report-only mode, tested against real sign-ins, and activated with break-glass accounts excluded before enforcement. Labs 03 and 05 cover this end to end.

SMS and voice one-time codes can be intercepted through SIM swapping, phishing proxies and SS7 attacks. Phishing-resistant MFA — FIDO2 security keys, passkeys and Windows Hello for Business — binds authentication to the legitimate site using public-key cryptography, so a proxied phishing page cannot replay it. Labs 02 and 04 migrate users off SMS and roll passwordless out to high-risk roles first.

PIM replaces standing administrative privilege with eligibility: an admin activates a role just-in-time, for a limited window, often with approval and justification, and the activation is logged. This shrinks the number of always-on privileged accounts an attacker can target. Lab 07 converts permanent role assignments into eligible, time-boxed access with approval workflows.

Identity Protection uses Microsoft's risk detections — impossible travel, anonymous IPs, leaked credentials, anomalous token activity — to score user and sign-in risk. You connect those risk levels to Conditional Access so risky sign-ins are challenged or blocked, and risky users are forced through secure password reset. Lab 10 wires risk signals into a repeatable response flow.

Secure Score is a measured percentage of recommended identity and security controls you have implemented, with a prioritized improvement list. It gives a programme a single number that moves as you harden the tenant, which is ideal for executive reporting. Lab 12 turns Secure Score and lab evidence into a board-ready remediation roadmap.

Conditional Access needs Entra ID P1; Privileged Identity Management, Identity Protection and access reviews need P2; sign-in activity reporting needs P1. The cleanest no-cost path for learning is an Entra ID P2 trial on a fresh, disposable Azure tenant. Lab 01 documents the current options and warns you never to run the track against production.