Entra ID Governance is the set of features for controlling access at scale — entitlement management with access packages, access reviews, lifecycle workflows and terms of use. It answers who should have access, for how long, and who signed off. The governance lab builds access packages and reviews so entitlements are requested, approved and recertified rather than granted once and forgotten.

An access package bundles the groups, apps and roles needed for a job function, with policies for who can request it, who approves, and when it expires. Entitlement management lets users request the package instead of chasing individual grants, and automatically removes access when it lapses. This turns ad-hoc access into governed, time-boxed, auditable assignments.

Sentinel is Microsoft's cloud-native SIEM and SOAR. For identity, it ingests Entra sign-in and audit logs, Identity Protection risk detections and more, then hunts across them with KQL, workbooks and automated playbooks. The Sentinel lab builds identity-focused queries and response playbooks so risky sign-ins and privilege changes are detected and acted on.

KQL (Kusto Query Language) is the query language behind Sentinel, Log Analytics and Defender. It lets you filter, correlate and summarize huge volumes of sign-in and audit data to find anomalies — brute force, impossible travel, mass consent, privilege escalation. Fluency in KQL is what turns raw identity logs into detections, which the Sentinel labs build up step by step.

Defender products extend identity signals with endpoint, cloud-app and identity-threat telemetry — for example Defender for Identity watches on-prem Active Directory for attacks like Kerberoasting, while Defender for Cloud Apps governs OAuth app consent and session risk. Correlating these with Entra sign-in data gives a fuller picture than any single source. The Microsoft security labs cover these touchpoints.

Multi-region deployments must weigh data residency, tenant partitioning, authentication latency and resilience against a regional outage. Decisions about where directory data lives, how many tenants you run, and how break-glass works across regions all affect both compliance and availability. The multi-region lab walks through these trade-offs.

You forward Entra sign-in and audit logs and Identity Protection risk events to the SOC's SIEM or MDR platform, map them to detection use cases, and define playbooks for identity incidents like risky sign-ins and privilege escalation. The ReliaQuest integration lab shows how identity signals feed a managed detection and response workflow.