Start knowing nothing. Finish as an identity expert.

48 hands-on labs in a deliberate order. Each builds on the last, from what a directory is through to designing identity architecture across clouds. No prior experience assumed at Level 1.

Start with Step 1 See the full path

The path

Work through the levels in order. Each level assumes you finished the one before, so the labs never stop to re-explain something you have already practised.

Level 1 · Start here

Foundations

7 labs · about 11 hours

No prior experience needed. What identity actually is, how directories store it, and how a machine proves who you are.

  1. 1 IAM Mastery Program: SAML, OAuth, OIDC and SCIM FoundationMulti-cloud / federation
  2. 2 IAM Fundamentals: Build an Identity Platform FoundationOn-premises AD and directory services
  3. 3 IAM Foundations: How Identity Security Works FoundationOn-premises AD and directory services
  4. 4 LDAP Fundamentals: Build a Directory Service FoundationOn-premises AD and directory services
  5. 5 SSH Key Authentication: A Complete Lab FoundationLinux and protocol fundamentals
  6. 6 AWS IAM Foundations: Users, Roles and Policies FoundationAmazon Web Services
  7. 7 GCP IAM Foundations: Hierarchy and Roles FoundationGoogle Cloud
Level 2 · Build the basics

Core Skills

9 labs · about 14 hours

The protocols every identity role runs on — federation, single sign-on — and your first real work inside Microsoft Entra.

  1. 8 SAML 2.0 Enterprise SSO: Hands-On Lab IntermediateThird-party vendor tooling
  2. 9 Build a Zero-Trust SSO Gateway IntermediateThird-party vendor tooling
  3. 10 Advanced SSH: Certificates, Bastions, Hardening AdvancedLinux and protocol fundamentals
  4. 11 Entra Identity Risk Baseline with PowerShell IntermediateMicrosoft Entra / Azure90 min
  5. 12 Migrate Off SMS to Microsoft Authenticator IntermediateMicrosoft Entra / Azure75 min
  6. 13 Entra SSPR and the Domain Takeover Risk IntermediateMicrosoft Entra / Azure90 min
  7. 14 Entra Access Reviews and Identity Hygiene IntermediateMicrosoft Entra / Azure100 min
  8. 15 Entra PowerShell Reporting at Scale IntermediateMicrosoft Entra / Azure110 min
  9. 16 AZ-104: Azure Identity and Governance IntermediateMicrosoft Entra / Azure
Level 3 · Job-ready

Professional

22 labs · about 36 hours

The work an identity engineer is actually paid for: hardening access, governing privilege, and proving it with detection and reporting.

  1. 17 Enforce MFA with Entra Conditional Access AdvancedMicrosoft Entra / Azure120 min
  2. 18 Phishing-Resistant MFA: FIDO2, TAP and Hello AdvancedMicrosoft Entra / Azure120 min
  3. 19 Automate Account Disablement for Missing MFA AdvancedMicrosoft Entra / Azure120 min
  4. 20 Just-in-Time Admin Access with Entra PIM AdvancedMicrosoft Entra / Azure110 min
  5. 21 Harden Entra Connect and Hybrid Identity AdvancedMicrosoft Entra / Azure120 min
  6. 22 Detect Identity Attacks with Defender IntermediateMicrosoft Entra / Azure100 min
  7. 23 Entra Secure Score and Stakeholder Reporting IntermediateMicrosoft Entra / Azure100 min
  8. 24 Microsoft Entra ID: Enterprise Identity and PIM AdvancedMicrosoft Entra / Azure
  9. 25 Entra ID Governance: Lifecycle and Entitlements AdvancedMicrosoft Entra / Azure
  10. 26 Hybrid Identity: Bridge AD to Cloud SSO AdvancedMicrosoft Entra / Azure
  11. 27 Advanced SSO: SCIM Provisioning and Risk Auth AdvancedThird-party vendor tooling
  12. 28 Microsoft Security Labs: Detect and Respond AdvancedMicrosoft Entra / Azure
  13. 29 ReliaQuest GreyMatter and Entra ID AdvancedMicrosoft Entra / Azure
  14. 30 HashiCorp Vault Privileged Access Management AdvancedThird-party vendor tooling
  15. 31 AWS IAM Identity Center: Workforce SSO AdvancedAmazon Web Services
  16. 32 AWS Organizations and Control Tower AdvancedAmazon Web Services
  17. 33 Kubernetes RBAC and Service Accounts AdvancedKubernetes
  18. 34 Active Directory Security Assessment Guide AdvancedOn-premises AD and directory services
  19. 35 Active Directory Remediation Playbooks AdvancedOn-premises AD and directory services
  20. 36 Build a SIEM and Home SOC with Wazuh AdvancedObservability and SIEM
  21. 37 Grafana Observability for IAM Environments AdvancedObservability and SIEM
  22. 38 Advanced Observability: Metrics, Logs, Traces AdvancedObservability and SIEM
Level 4 · Lead the design

Expert

10 labs · about 15 hours

Architecture across regions and clouds, the judgement to review someone else’s design, and the credentials to back it.

  1. 39 Multi-Region Identity Architecture with Entra ExpertMicrosoft Entra / Azure
  2. 40 Microsoft Sentinel for Identity Security ExpertMicrosoft Entra / Azure
  3. 41 Multi-Cloud Identity Federation ExpertMulti-cloud / federation
  4. 42 Teleport: Zero Trust Access to SSH and K8s ExpertThird-party vendor tooling
  5. 43 Zero Trust Identity Architecture ExpertMulti-cloud / federation
  6. 44 IAM Architecture Review: A Case Study ExpertMulti-cloud / federation
  7. 45 CISSP Study Plan for IAM Professionals ExpertMulti-cloud / federation
  8. 46 CREST CPSA Study Plan IntermediateMulti-cloud / federation
  9. 47 Identity Security Assessment Proposal Template ExpertMulti-cloud / federation
  10. 48 IAM and PAM Interview Questions Guide FoundationMulti-cloud / federation

Before you start

Everything here runs on software you can obtain without a licence. Labs that required licence-only products were removed.