Microsoft Entra ID (formerly Azure Active Directory) is the world's most widely deployed cloud identity platform, used by over 300 million users across 500,000+ organizations. It's the identity backbone for Microsoft 365, Azure, and thousands of SaaS applications. In this lab, you'll configure an Entra ID tenant from scratch, onboard applications with SSO, implement Conditional Access policies, and deploy Privileged Identity Management (PIM) for just-in-time administrative access. These are the core skills required for any enterprise IAM engineer working with Microsoft technologies.
Microsoft Entra ID is a cloud-based identity and access management service that helps employees sign in and access external resources (Microsoft 365, Azure portal, thousands of SaaS applications) and internal resources (apps on your corporate network, cloud apps developed by your organization). Unlike on-premises Active Directory, Entra ID is designed for cloud-first scenarios with built-in support for modern protocols (OIDC, SAML, SCIM), conditional access, and advanced security features like risk-based authentication and privileged identity management.
Prerequisites
Azure Account: Free tier or paid subscription (P1/P2 for advanced features)
Global Administrator: Or ability to create a new tenant
IAM Foundations: Concepts from LABs 5-7 (SSO, SAML, OIDC)
Browser: Modern browser with JavaScript enabled
License Requirements
Some features in this lab require premium licenses:
Entra ID Free: Basic user/group management, SSO (limited)
Entra ID P1: Conditional Access, Group-based licensing, Self-service password reset
Entra ID P2: PIM, Identity Protection, Access Reviews
Tip: Azure free trial includes P2 features for 30 days.
What You Will Build
Configured Tenant: Entra ID tenant with security defaults and custom branding
User Management: Users, groups, administrative units, and dynamic membership
Application SSO: Enterprise apps with SAML and OIDC single sign-on
Conditional Access: Policies requiring MFA, compliant devices, and location restrictions
PIM Configuration: Just-in-time privileged access for Global Admin and other roles
Identity Protection: Risk-based policies for sign-in and user risk
Monitoring: Audit logs, sign-in logs, and security alerts
Learning Objectives
Understand Entra ID architecture: tenants, directories, and objects
Configure users, groups, and administrative boundaries
Register applications and configure enterprise app SSO
Implement SAML and OIDC single sign-on flows
Design and deploy Conditional Access policies
Configure Privileged Identity Management for JIT access
Enable Identity Protection with risk-based policies
Analyze sign-in logs and audit trails for security monitoring
You're the Identity Architect at NexGen Financial, and the CIO has mandated a cloud-first identity strategy:
"We're moving to Microsoft 365 and migrating applications to Azure. Our legacy AD isn't cutting it anymore—we need Single Sign-On for 200+ SaaS apps, we need to eliminate standing admin access, and we need visibility into who's accessing what. Compliance is breathing down our necks about privileged access reviews. Build us a modern identity platform on Entra ID."
Unified identity for Microsoft 365, Azure, and SaaS applications
Zero Trust access with Conditional Access policies
Eliminate standing privileges with PIM just-in-time access
Automated provisioning to downstream applications
Compliance-ready with audit logs and access reviews
Skills You Will Gain
Enterprise IAM
Configure cloud identity for organizations of any size.
Application SSO
Onboard applications with SAML 2.0 and OpenID Connect.
Analyze logs for security incidents and compliance.
Entra ID Architecture & Core Concepts
Before diving into configuration, you must understand Entra ID's architecture. Unlike on-premises Active Directory, Entra ID is a flat directory (no OUs or forests) designed for cloud-scale with different object types and relationships.
What is Microsoft Entra ID?
Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service providing:
Authentication: Verify user identity with passwords, MFA, passwordless, and risk-based authentication
Single Sign-On: One identity for Microsoft 365, Azure, and thousands of SaaS apps
Application Management: Manage access to cloud and on-premises applications
Device Management: Register and manage devices for conditional access
B2B Collaboration: Invite external users as guests
B2C Identity: Customer-facing identity for consumer applications
Core Entra ID Components
Tenant
A dedicated instance of Entra ID for your organization. Each tenant has a unique ID and one or more verified domains (e.g., contoso.onmicrosoft.com).
Users
Identity objects representing people. Can be cloud-only, synced from on-premises AD, or guest users from external organizations (B2B).
Groups
Collections of users for access management. Types: Security groups, Microsoft 365 groups. Membership: Assigned or Dynamic.
Applications
Two types: App Registrations (your apps) and Enterprise Applications (SaaS apps). Both support SSO and provisioning.
Service Principals
Application identities in your tenant. When you consent to an app, a service principal is created for it in your directory.
Roles
Built-in and custom roles for delegated administration. Global Admin is the most powerful; use PIM to make it just-in-time.
ENTRA ID ARCHITECTURE
1
Identity Sources
Cloud Users, Synced from AD (via Entra Connect), Guest Users (B2B), External Identities (B2C)
This lab uses the Microsoft Entra Admin Center (entra.microsoft.com) and optionally Azure CLI/PowerShell for automation. You'll need an Azure account with the ability to create or access an Entra ID tenant.
Device Badges Legend
Entra Portalentra.microsoft.com
Azure CLIaz commands
PowerShellMicrosoft.Graph module
Web BrowserTesting SSO flows
ApplicationTest applications
0
Create or Access Azure Account
If you don't have an Azure account, create one. A free trial includes Entra ID P2 for 30 days.
Web Browser
1. Go to: https://azure.microsoft.com/free/
2. Click "Start free" or "Try Azure for free"
3. Sign in with Microsoft account or create new one
4. Complete verification (phone + credit card)
5. Access Entra Admin Center: https://entra.microsoft.com
Note: Free trial includes:
- 12 months of free services
- $200 credit for 30 days
- Entra ID P2 features for 30 days
Module 1: Tenant Configuration & User Management
Module 1: Set Up Your Entra ID Tenant
Configure tenant settings, custom domains, and create your first users.
45-60 minutes6 stepsEntra Portal
Every Entra ID deployment starts with tenant configuration. You'll configure basic settings, understand security defaults, optionally add a custom domain, and create users that represent your organization's workforce.
1
Access Entra Admin Center
Entra Portal
1. Navigate to: https://entra.microsoft.com
2. Sign in with your Global Administrator account
3. You'll land on the Entra ID Overview page
Key information displayed:
- Tenant ID: Your unique directory identifier
- Primary domain: yourorg.onmicrosoft.com
- License: Free, P1, or P2
2
Review Tenant Properties
Entra Portal
Navigate to: Identity Overview Properties
Review and configure:
- Name: Display name for your organization
- Country or region: Primary location
- Notification language: Email language
- Technical contact: Email for service notifications
- Global privacy contact: For privacy requests
- Privacy statement URL: Your privacy policy
Click "Save" after any changes
3
Configure Security Defaults
Security defaults provide baseline protection. Review them even if using Conditional Access.
Entra Portal
Navigate to: Identity Overview Properties
Scroll to: Security defaults (Manage security defaults)
Security Defaults include:
- Require all users to register for MFA
- Require admins to perform MFA
- Block legacy authentication protocols
- Protect privileged activities (Azure portal access)
For this lab (if you have P1/P2):
- Set Security defaults to "Disabled"
- We'll use Conditional Access for more control
Note: Keep Security defaults ENABLED if you don't
have P1/P2 licenses for Conditional Access
4
Create Test Users
Entra Portal
Navigate to: Identity Users All users New user Create new user
Create User 1 - Regular Employee:
- User principal name: alice@yourdomain.onmicrosoft.com
- Display name: Alice Johnson
- Password: Auto-generate or set custom
- First name: Alice
- Last name: Johnson
- Job title: Software Engineer
- Department: Engineering
Click "Create"
Create User 2 - Manager:
- User principal name: bob@yourdomain.onmicrosoft.com
- Display name: Bob Smith
- Job title: Engineering Manager
- Department: Engineering
Click "Create"
Create User 3 - Finance:
- User principal name: carol@yourdomain.onmicrosoft.com
- Display name: Carol Davis
- Job title: Financial Analyst
- Department: Finance
Click "Create"
Create User 4 - IT Admin:
- User principal name: dave@yourdomain.onmicrosoft.com
- Display name: Dave Wilson
- Job title: IT Administrator
- Department: IT
Click "Create"
5
Create Users via PowerShell (Optional)
PowerShell
# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser
# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.ReadWrite.All"
# Create a user
$PasswordProfile = @{
Password = "TempP@ssw0rd123!"
ForceChangePasswordNextSignIn = $true
}
New-MgUser -DisplayName "Eve Martinez" `
-UserPrincipalName "eve@yourdomain.onmicrosoft.com" `
-MailNickname "eve" `
-PasswordProfile $PasswordProfile `
-AccountEnabled `
-Department "Sales" `
-JobTitle "Sales Representative"
# List all users
Get-MgUser -All | Select-Object DisplayName, UserPrincipalName, Department
6
Configure User Settings
Entra Portal
Navigate to: Identity Users User settings
Configure these settings:
- App registrations:
Users can register applications: Yes (for dev) or No (restrictive)
- Administration portal:
Restrict access to Entra admin center: No (allows read-only)
- LinkedIn account connections:
Allow users to connect work account: Based on policy
- External collaboration settings:
Click "Manage external collaboration settings"
Guest user access: Limited (recommended)
Guest invite restrictions: Admins and users in specific roles
Click "Save"
Module 1 Complete!
Your tenant is configured with basic settings and test users. In Module 2, we'll organize users into groups.
Module 2: Group Management & Dynamic Membership
Module 2: Organize Users with Groups
Create security groups, Microsoft 365 groups, and dynamic membership rules.
30-45 minutes5 stepsEntra Portal
Groups in Entra ID are essential for access management. Instead of assigning permissions to individual users, you assign to groups. Dynamic groups automatically add/remove users based on attributes, reducing administrative overhead.
7
Create Security Groups
Entra Portal
Navigate to: Identity Groups All groups New group
Create Group 1 - Engineering Team:
- Group type: Security
- Group name: SG-Engineering
- Group description: Engineering department security group
- Membership type: Assigned
- Owners: Add yourself
- Members: Add alice@..., bob@...
Click "Create"
Create Group 2 - Finance Team:
- Group type: Security
- Group name: SG-Finance
- Membership type: Assigned
- Members: Add carol@...
Click "Create"
Create Group 3 - IT Admins:
- Group type: Security
- Group name: SG-IT-Admins
- Membership type: Assigned
- Members: Add dave@...
Click "Create"
8
Create Dynamic Security Group (P1/P2)
Dynamic groups automatically manage membership based on user attributes.
Entra Portal
Navigate to: Identity Groups All groups New group
Create Dynamic Group - All Employees:
- Group type: Security
- Group name: SG-All-Employees-Dynamic
- Membership type: Dynamic User
- Click "Add dynamic query"
Dynamic membership rule:
(user.accountEnabled -eq true) and (user.userType -eq "Member")
Click "Save" then "Create"
Create Dynamic Group - Engineering Only:
- Group name: SG-Engineering-Dynamic
- Membership type: Dynamic User
- Rule: (user.department -eq "Engineering")
Click "Create"
Note: Dynamic membership processing takes a few minutes
9
Create Microsoft 365 Group
Entra Portal
Navigate to: Identity Groups All groups New group
Create Microsoft 365 Group:
- Group type: Microsoft 365
- Group name: Project-Alpha-Team
- Group email address: project-alpha@yourdomain.onmicrosoft.com
- Group description: Cross-functional project team
- Membership type: Assigned
- Owners: Add bob@...
- Members: Add alice@..., carol@...
Click "Create"
Microsoft 365 groups include:
- Shared mailbox
- SharePoint site
- Teams channel (if Teams enabled)
- Planner board
Navigate to: Identity Groups General (settings)
Configure:
- Self-service group management:
Owners can manage group membership: Yes
- Security groups:
Users can create security groups: No (recommended)
- Microsoft 365 groups:
Users can create Microsoft 365 groups: No or specific groups
Navigate to: Identity Groups Naming policy
- Add prefixes/suffixes for group naming conventions
- Block certain words in group names
Navigate to: Identity Groups Expiration
- Set expiration for Microsoft 365 groups (P1+)
Module 2 Complete!
You've created security and dynamic groups. In Module 3, we'll register and configure applications.
Understand the difference between App Registrations and Enterprise Apps, and configure both.
45-60 minutes6 stepsEntra Portal
Entra ID has two application concepts: App Registrations (for apps you develop) and Enterprise Applications (for apps you use). When you register an app, you define its identity; when you add an Enterprise App, you're trusting a third-party app in your tenant.
App Registration vs Enterprise Application
App Registration: The application's identity definition. Contains client ID, redirect URIs, API permissions, and credentials. Think of it as the app's "passport."
Enterprise Application (Service Principal): An instance of an app in your tenant. Controls who can use it, what permissions are granted, and SSO configuration. Think of it as the app's "visa" to your tenant.
Relationship: When you create an App Registration, an Enterprise App is automatically created. When you add a Gallery app, it creates an Enterprise App that references Microsoft's App Registration.
12
Create an App Registration (Custom App)
Entra Portal
Navigate to: Identity Applications App registrations New registration
Register your custom application:
- Name: TechStart Internal Portal
- Supported account types:
"Accounts in this organizational directory only (Single tenant)"
- Redirect URI:
Platform: Web
URL: https://localhost:5000/callback
Click "Register"
After creation, note these values:
- Application (client) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- Directory (tenant) ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
- Object ID: For this specific app registration
13
Configure App Authentication
Entra Portal
Navigate to: App registrations TechStart Internal Portal Authentication
Add additional redirect URIs:
Add URI: http://localhost:5000/callback (for local dev)
Add URI: https://portal.techstart.local/callback (for prod)
Configure platform settings:
- Front-channel logout URL: https://portal.techstart.local/logout
- ID tokens: ✓ Check (for OIDC flows)
- Access tokens: ✓ Check (for API access)
Advanced settings:
- Allow public client flows: No (for web apps)
Click "Save"
14
Create Client Secret
Entra Portal
Navigate to: App registrations TechStart Internal Portal Certificates & secrets
Create a client secret:
Click "New client secret"
- Description: Portal-Secret-2024
- Expires: 24 months (or 6 months for higher security)
Click "Add"
IMPORTANT: Copy the secret VALUE immediately!
It will only be shown once. Store it securely.
Secret ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Value: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
For production, consider using certificates instead:
Upload certificate: More secure, no secret to manage
15
Configure API Permissions
Entra Portal
Navigate to: App registrations TechStart Internal Portal API permissions
Add permissions for Microsoft Graph:
Click "Add a permission"
Select "Microsoft Graph"
Choose "Delegated permissions"
Add these permissions:
- openid (Sign users in)
- profile (View users' basic profile)
- email (View users' email address)
- User.Read (Sign in and read user profile)
- Group.Read.All (Read all groups) [Optional]
Click "Add permissions"
Grant admin consent (if admin):
Click "Grant admin consent for [Your Tenant]"
Confirm
Status should show green checkmarks for all permissions
16
Add Enterprise App from Gallery
Add a pre-integrated SaaS application from the Entra gallery.
Entra Portal
Navigate to: Identity Applications Enterprise applications
Click "New application"
Search the gallery:
- Type "Salesforce" (or any common SaaS app)
- Select "Salesforce" from results
Click "Create"
Alternative - Add non-gallery app:
Click "Create your own application"
- Name: Custom SAML App
- Select: "Integrate any other application..."
Click "Create"
The Enterprise Application is now in your tenant.
Next module: Configure SSO for this app.
17
Assign Users to Application
Entra Portal
Navigate to: Enterprise applications Salesforce Users and groups
Add user/group assignment:
Click "Add user/group"
Under Users: Select "SG-Engineering" group (or individual users)
Under Role: Select role if app supports it
Click "Assign"
Configure assignment requirement:
Navigate to: Enterprise applications Salesforce Properties
- Assignment required? Yes (only assigned users can access)
- Visible to users? Yes (shows in My Apps portal)
Click "Save"
Note: If "Assignment required" is No, all users
in tenant can access the application.
Module 3 Complete!
You've registered custom apps and added gallery apps. In Module 4, we'll configure SSO.
Module 4: Single Sign-On Configuration (SAML & OIDC)
Module 4: Configure SSO for Enterprise Applications
Set up SAML and OIDC single sign-on for applications.
60-90 minutes6 stepsEntra Portal
Entra ID supports multiple SSO methods: SAML 2.0 (most common for enterprise SaaS), OpenID Connect (modern apps), Password-based (legacy apps), and Linked (redirects to external URL). You'll configure both SAML and OIDC SSO in this module.
18
Configure SAML SSO
Entra Portal
Navigate to: Enterprise applications [Your App] Single sign-on
Select "SAML"
Section 1: Basic SAML Configuration
Click "Edit"
- Identifier (Entity ID): Your app's entity ID
Example: https://app.example.com/saml
- Reply URL (ACS URL): Where SAML response is sent
Example: https://app.example.com/saml/acs
- Sign on URL (Optional): SP-initiated SSO URL
Example: https://app.example.com/login
- Relay State (Optional): Where to redirect after SSO
- Logout URL (Optional): Single logout URL
Click "Save"
Section 2: Attributes & Claims
Click "Edit"
Default claims sent:
- Unique User Identifier (Name ID): user.userprincipalname
- givenname: user.givenname
- surname: user.surname
- emailaddress: user.mail
- name: user.displayname
Add custom claim:
Click "Add new claim"
- Name: department
- Source: Attribute
- Source attribute: user.department
Click "Save"
19
Download SAML Certificates
Entra Portal
Section 3: SAML Certificates
This section shows the signing certificate used by Entra ID.
Download options:
- Certificate (Base64): For most applications
- Certificate (Raw): Binary format
- Federation Metadata XML: Complete metadata file
Click "Download" next to Federation Metadata XML
This contains everything the SP needs:
- IdP Entity ID
- SSO URL
- Signing certificates
Certificate management:
- Default validity: 3 years
- Notification email: Set to receive renewal reminders
Click "Edit" to configure notification settings
Plan certificate rotation before expiration!
20
Copy SAML Configuration URLs
Entra Portal
Section 4: Set up [Your App]
Copy these values for your Service Provider:
Login URL:
https://login.microsoftonline.com/{tenant-id}/saml2
Azure AD Identifier (IdP Entity ID):
https://sts.windows.net/{tenant-id}/
Logout URL:
https://login.microsoftonline.com/{tenant-id}/saml2
Provide these to your application's SAML configuration,
or use the Federation Metadata XML which contains all.
21
Test SAML SSO
Entra Portal
Section 5: Test single sign-on
Click "Test" button
If you have a test user assigned:
1. Select test user (or sign in as assigned user)
2. Click "Test sign in"
3. Entra will attempt SSO to the application
4. Review results - success or error details
Common test errors:
- "AADSTS50105": User not assigned to application
Fix: Assign user/group in "Users and groups"
- "AADSTS700016": App not found
Fix: Check Application ID and tenant
- "Invalid signature": Certificate mismatch
Fix: Re-download certificate to SP
Use browser developer tools (F12) Network tab
to inspect SAML request/response for debugging.
22
Configure OIDC SSO (App Registration)
Entra Portal
For OIDC apps, SSO is configured via App Registration.
Navigate to: App registrations TechStart Internal Portal
The OIDC endpoints are automatically available:
- Authorization: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
- Token: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
- UserInfo: https://graph.microsoft.com/oidc/userinfo
- JWKS: https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys
OpenID Connect metadata document:
https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
Your app needs:
- Client ID: From app registration overview
- Client Secret: From certificates & secrets
- Redirect URI: Configured in authentication
- Scopes: openid profile email
23
Test OIDC Flow
Web Browser
# Test authorization endpoint in browser
# Replace {tenant-id} and {client-id} with your values
https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize?
client_id={client-id}
&response_type=code
&redirect_uri=https://localhost:5000/callback
&response_mode=query
&scope=openid%20profile%20email
&state=12345
# This should:
# 1. Redirect to Microsoft login
# 2. After auth, redirect to your callback with code
# 3. Your app exchanges code for tokens
# To decode returned tokens:
# Visit https://jwt.ms and paste the ID token
Module 4 Complete!
You've configured both SAML and OIDC SSO. In Module 5, we'll implement Conditional Access.
Module 5: Conditional Access Policies
Module 5: Implement Zero Trust with Conditional Access
Create policies that require MFA, restrict locations, and enforce device compliance.
60-90 minutes6 stepsEntra Portal
Conditional Access is Entra ID's Zero Trust policy engine. It evaluates signals (user, device, location, app, risk) and enforces access controls (grant, block, require MFA). Every authentication request passes through Conditional Access evaluation. This is the most powerful security feature in Entra ID.
Conditional Access Signals & Controls
Signals (Conditions):
User/Group: Specific users, groups, roles, or all users
Define trusted network locations for conditional access policies.
Entra Portal
Navigate to: Protection Conditional Access Named locations
Click "New location"
Create IP-based location:
- Name: Corporate Office
- Select "IP ranges location"
- Mark as trusted location: ✓ Yes
- Add IP ranges:
203.0.113.0/24 (your corporate IP range)
198.51.100.0/24 (branch office)
Click "Create"
Create Countries location:
Click "New location"
- Name: Allowed Countries
- Select "Countries location"
- Countries: United States, Canada, United Kingdom
- Include unknown countries: No
Click "Create"
25
Policy 1: Require MFA for All Users
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: CA001-Require-MFA-AllUsers
Assignments:
- Users: Include "All users"
- Exclude: Emergency access accounts (break-glass)
Target resources:
- Cloud apps: Include "All cloud apps"
Conditions:
- (Leave default - no specific conditions)
Access controls Grant:
- Select "Grant access"
- ✓ Require multifactor authentication
- For multiple controls: Require all
Session: (Leave default)
Enable policy: Report-only (for testing)
Click "Create"
Always test in Report-only mode first!
Review sign-in logs to see impact before enabling.
26
Policy 2: Block Legacy Authentication
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: CA002-Block-Legacy-Auth
Assignments:
- Users: Include "All users"
- Exclude: Service accounts if needed
Target resources:
- Cloud apps: Include "All cloud apps"
Conditions:
Click "Client apps"
- Configure: Yes
- Select these legacy clients:
✓ Exchange ActiveSync clients
✓ Other clients (IMAP, POP3, SMTP)
- Deselect modern auth clients:
☐ Browser
☐ Mobile apps and desktop clients
Access controls Grant:
- Select "Block access"
Enable policy: Report-only
Click "Create"
Why block legacy auth?
- No MFA support
- No Conditional Access support
- Primary vector for password spray attacks
27
Policy 3: Require MFA Outside Trusted Locations
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: CA003-MFA-Outside-Corporate
Assignments:
- Users: Include "All users"
Target resources:
- Cloud apps: Include "All cloud apps"
Conditions:
Click "Locations"
- Configure: Yes
- Include: Any location
- Exclude: Select "Corporate Office" (trusted location)
Access controls Grant:
- Select "Grant access"
- ✓ Require multifactor authentication
Enable policy: Report-only
Click "Create"
This allows password-only from office,
requires MFA from all other locations.
28
Policy 4: Require Compliant Device for Sensitive Apps
Entra Portal
Navigate to: Protection Conditional Access Policies
Click "New policy"
Name: CA004-Compliant-Device-SensitiveApps
Assignments:
- Users: Include "SG-Finance" group
Target resources:
- Cloud apps: Include Select apps
Select your sensitive financial applications
Conditions:
Click "Device platforms"
- Configure: Yes
- Include: Select platforms (Windows, iOS, Android)
Access controls Grant:
- Select "Grant access"
- ✓ Require device to be marked as compliant
(Requires Intune enrollment)
OR
- ✓ Require Hybrid Azure AD joined device
(For domain-joined devices)
Enable policy: Report-only
Click "Create"
Note: Device compliance requires Microsoft Intune.
29
Review Conditional Access Insights
Entra Portal
Navigate to: Protection Conditional Access Insights and reporting
Report-only impact analysis:
- Shows what would happen if policies were enabled
- Filter by policy, user, application
- Review before switching to "On"
Navigate to: Identity Monitoring Sign-in logs
Click on any sign-in entry
Expand "Conditional Access" tab
Shows:
- Which policies were evaluated
- Result: Success, Failure, Not applied
- Grant controls applied
- Why policy did/didn't apply
When confident:
Navigate to: Each policy Enable policy: On
Click "Save"
Enable policies one at a time and monitor!
Module 5 Complete!
You've implemented Zero Trust Conditional Access policies. In Module 6, we'll configure PIM.
Eliminate standing administrative access with time-bound, approval-based role activation.
60-90 minutes8 stepsEntra Portal
Privileged Identity Management (PIM) is Entra ID's PAM solution. Instead of users having permanent admin roles, PIM makes them "eligible" for roles. Users must activate the role when needed, with optional approval workflows and time limits. This dramatically reduces the attack surface—if an admin account is compromised, the attacker doesn't automatically get admin privileges.
License Requirement
PIM requires Entra ID P2 license. If using Azure free trial, P2 features are available for 30 days.
PIM Core Concepts
Eligible Assignment: User CAN activate the role when needed (not currently active)
Active Assignment: User HAS the role right now (permanent or time-bound)
Activation: Process of converting eligible to active for a limited time
Approval: Optional workflow requiring another admin to approve activation
Justification: Reason provided when activating (for audit trail)
Maximum Duration: How long an activation can last (e.g., 8 hours)
30
Access Privileged Identity Management
Entra Portal
Navigate to: Identity governance Privileged Identity Management
Or direct URL: https://entra.microsoft.com/#view/Microsoft_Azure_PIMCommon/CommonMenuBlade
PIM Dashboard shows:
- Your role assignments
- Pending approvals (if you're an approver)
- Recent activity
- Recommendations
Quick tasks:
- My roles: See what you can activate
- Approve requests: Review pending activations
- Audit history: View all PIM activities
31
Configure Entra ID Roles in PIM
Entra Portal
Navigate to: PIM Microsoft Entra roles Roles
You'll see all Entra ID built-in roles:
- Global Administrator (most privileged)
- User Administrator
- Application Administrator
- Security Administrator
- etc.
Click on "Global Administrator" to see:
- Active assignments (permanent admins)
- Eligible assignments (can-activate admins)
- Settings (activation rules)
Our goal: Convert permanent admins to eligible,
require approval for Global Admin activation.
32
Configure Role Settings
Entra Portal
Navigate to: PIM Microsoft Entra roles Settings
Click on "Global Administrator"
Click "Edit"
Activation tab:
- Activation maximum duration: 8 hours
- On activation, require:
✓ Azure MFA
✓ Justification
☐ Ticket information (optional for ITSM)
- Require approval to activate: ✓ Yes
- Select approvers:
Add another Global Admin or Security team
Assignment tab:
- Allow permanent eligible assignment: No
- Expire eligible assignments after: 365 days
- Allow permanent active assignment: No
- Expire active assignments after: (disabled if no permanent)
- Require Azure MFA on active assignment: Yes
- Require justification on active assignment: Yes
Notification tab:
- Send notifications when members are assigned as eligible
- Send notifications when members are assigned as active
- Send notification when eligible members activate
Click "Update"
33
Add Eligible Assignments
Entra Portal
Navigate to: PIM Microsoft Entra roles Roles
Click "Global Administrator"
Click "Add assignments"
Select members:
Click "No member selected"
Search and select: dave@yourdomain.onmicrosoft.com (IT Admin)
Click "Select"
Setting - Assignment type:
- Select: Eligible
Setting - Duration:
- Eligible permanently: No
- Eligible start: [Today]
- Eligible end: [1 year from now]
Click "Assign"
Dave now has ELIGIBLE Global Admin role.
He must ACTIVATE it to use admin capabilities.
Repeat for other roles:
- Add Alice as eligible "Application Administrator"
- Add Bob as eligible "User Administrator"
34
Test Role Activation (User Experience)
Experience the PIM activation workflow as an eligible user.
Entra Portal
Sign out and sign in as dave@yourdomain.onmicrosoft.com
Navigate to: PIM My roles Entra ID roles
Dave sees:
- Eligible assignments: Global Administrator
- Active assignments: (empty)
To activate:
Click "Activate" next to Global Administrator
Provide justification: "Need to investigate security alert #12345"
Set duration: 4 hours (within max 8 hours)
Click "Activate"
If approval required:
- Status shows: "Pending approval"
- Approvers receive email notification
- Dave waits for approval
If no approval required:
- MFA challenge appears
- After MFA, role is immediately active
Once active:
- Dave can perform Global Admin tasks
- Role automatically deactivates after duration
35
Approve Activation Request (Approver Experience)
Entra Portal
Sign in as an approver (you or designated approver)
Navigate to: PIM Approve requests
Pending requests show:
- Requestor: dave@...
- Role: Global Administrator
- Justification: "Need to investigate security alert #12345"
- Requested duration: 4 hours
- Time requested: [timestamp]
To approve:
Select the request
Click "Approve"
Provide approval reason: "Verified security incident exists"
Click "Confirm"
To deny:
Select the request
Click "Deny"
Provide denial reason: "Please use specific role instead"
Click "Confirm"
After approval:
- Requestor's role is immediately activated
- Requestor receives email notification
- Audit log records the approval
36
Review PIM Audit History
Entra Portal
Navigate to: PIM Microsoft Entra roles Audit history
Filter and view:
- All PIM activities in your tenant
- Filter by: Date range, user, role, activity type
Activity types tracked:
- Add member to role (eligible)
- Add member to role (active)
- Remove member from role
- Role activation requested
- Role activation approved/denied
- Role deactivated (manual or expired)
- Role settings changed
Export for compliance:
Click "Export"
Download CSV or JSON for retention
Also available in:
- Azure Monitor logs (for SIEM integration)
- Microsoft Sentinel (for security analysis)
37
Configure Access Reviews for Privileged Roles
Entra Portal
Navigate to: Identity governance Access reviews
Click "New access review"
Review type:
- Select: Teams + Groups, or Applications, or Entra ID roles
Select "Microsoft Entra roles"
Select roles:
Choose: Global Administrator, User Administrator
(roles to review)
Scope:
- Everyone (all assigned users)
Specify reviewers:
- Reviewer type: Manager, Self, or Specific reviewers
Select: "Specific reviewers"
Add: Security team or Compliance team
Settings:
- Duration: 14 days
- Recurrence: Quarterly
- Auto-apply results: Yes (remove access if not approved)
- If reviewers don't respond: Remove access (strict) or
No change (lenient)
Click "Create"
Reviewers receive email to review each user's
continued need for the privileged role.
Module 6 Complete!
You've implemented just-in-time privileged access with PIM. In Module 7, we'll configure Identity Protection.
Module 7: Identity Protection & Risk Policies
Module 7: Enable Risk-Based Authentication
Detect risky sign-ins and compromised users with machine learning.
45-60 minutes5 stepsEntra Portal
Identity Protection uses machine learning to detect suspicious activities and risky sign-ins. It evaluates signals like impossible travel, anonymous IP, password spray patterns, and leaked credentials to assign risk levels. You can then create policies that respond to risk—requiring MFA, blocking access, or forcing password reset.
38
Review Risk Detections
Entra Portal
Navigate to: Protection Identity Protection Overview
Dashboard shows:
- Users at risk: Accounts with detected compromise indicators
- Risky sign-ins: Authentication attempts flagged as suspicious
- Risk detections: Individual suspicious events
Risk detection types:
Sign-in risk:
- Anonymous IP address
- Atypical travel (impossible travel)
- Malware linked IP address
- Unfamiliar sign-in properties
- Password spray
- Suspicious inbox forwarding
User risk:
- Leaked credentials (found on dark web)
- Azure AD threat intelligence
- Anomalous user activity
Click into each section to investigate.
39
Configure Sign-in Risk Policy
Entra Portal
Navigate to: Protection Identity Protection Sign-in risk policy
Or use Conditional Access (recommended for more control):
Navigate to: Protection Conditional Access New policy
Name: CA-SignIn-Risk-MFA
Assignments:
- Users: All users (exclude break-glass)
Target resources:
- All cloud apps
Conditions:
Click "Sign-in risk"
- Configure: Yes
- Select risk levels:
✓ High
✓ Medium
☐ Low (optional, may cause friction)
☐ No risk
Access controls Grant:
- Grant access
- ✓ Require multifactor authentication
Enable policy: Report-only first
Click "Create"
Effect: Risky sign-ins require MFA verification,
which blocks attackers who only have password.
40
Configure User Risk Policy
Entra Portal
Navigate to: Protection Conditional Access New policy
Name: CA-User-Risk-PasswordChange
Assignments:
- Users: All users
Target resources:
- All cloud apps
Conditions:
Click "User risk"
- Configure: Yes
- Select risk levels:
✓ High
✓ Medium
Access controls Grant:
- Grant access
- ✓ Require password change
(Forces user to change password via SSPR)
- ✓ Require multifactor authentication
Enable policy: Report-only first
Click "Create"
Effect: Users with leaked/compromised credentials
must reset password before accessing resources.
41
Investigate Risky Users
Entra Portal
Navigate to: Protection Identity Protection Risky users
For each risky user, you can:
- View risk history: See all detections
- View risky sign-ins: Specific suspicious logins
- Confirm user compromised: Raises risk to High
- Dismiss user risk: After remediation
- Reset password: Force credential change
- Block user: Prevent all sign-ins
Investigation workflow:
1. Review detection details
2. Contact user if needed
3. Determine if legitimate or attack
4. If attack: Reset password, revoke sessions
5. If false positive: Dismiss risk
6. Document in ticketing system
42
Enable MFA Registration Policy
Entra Portal
Navigate to: Protection Identity Protection MFA registration policy
Configure:
- Users: All users (or specific groups)
- Exclude: Emergency access accounts
- Enforce policy: On
This policy forces users to register for MFA
during their next sign-in if they haven't already.
Combined with sign-in risk policy, this ensures:
1. Users register MFA
2. Risky sign-ins require MFA
3. Attackers can't authenticate even with password
Module 7 Complete!
You've enabled risk-based authentication. In Module 8, we'll explore audit logs and monitoring.
Module 8: Audit Logs & Sign-in Monitoring
Module 8: Monitor Identity Activities
Analyze sign-in logs, audit trails, and configure alerts.
30-45 minutes4 stepsEntra Portal
Entra ID maintains comprehensive logs of all identity activities. Sign-in logs track authentication attempts, audit logs track administrative changes, and provisioning logs track user provisioning to applications. Understanding these logs is essential for security monitoring, compliance, and troubleshooting.
43
Explore Sign-in Logs
Entra Portal
Navigate to: Identity Monitoring Sign-in logs
Default view shows:
- Date, User, Application, Status, IP, Location
Add columns for more detail:
Click "Columns"
Add: Conditional Access, Device, Client app, MFA
Filter options:
- Date: Last 24 hours, 7 days, 30 days, custom
- User: Specific users
- Application: Specific apps
- Status: Success, Failure, Interrupted
- Conditional Access: Applied, Not applied
Click any entry to see details:
- Basic info: User, app, IP, device
- Location: Map and coordinates
- Device info: OS, browser, compliance
- Conditional Access: Policies evaluated, result
- Authentication details: Methods used, MFA result
- Additional details: Error codes, failure reasons
44
Analyze Audit Logs
Entra Portal
Navigate to: Identity Monitoring Audit logs
Audit logs track administrative changes:
- User created/deleted/modified
- Group membership changes
- Application consent
- Policy changes
- Role assignments
- Password resets
- And much more
Filter options:
- Date range
- Service: Core Directory, PIM, Access Reviews, etc.
- Category: User Management, Group Management, etc.
- Activity: Specific action
- Initiated by: Who made the change
- Target: What was changed
Key activities to monitor:
- "Add member to role" (privilege escalation)
- "Add owner to application" (app takeover)
- "Update application – Certificates and secrets"
- "Consent to application" (OAuth phishing)
- "Delete user" (account removal)
45
Configure Log Analytics (Optional)
Entra Portal
Navigate to: Identity Monitoring Diagnostic settings
Click "Add diagnostic setting"
Log Analytics enables:
- Long-term retention (beyond 30 days)
- Custom queries with KQL
- Alerts and workbooks
- Integration with Microsoft Sentinel
Configure:
- Name: EntraID-Logs-to-LA
- Logs:
✓ AuditLogs
✓ SignInLogs
✓ NonInteractiveUserSignInLogs
✓ ServicePrincipalSignInLogs
✓ ManagedIdentitySignInLogs
✓ ProvisioningLogs
✓ RiskyUsers
✓ UserRiskEvents
- Destination:
✓ Send to Log Analytics workspace
Select workspace (create one if needed)
Click "Save"
Logs now flow to Log Analytics for advanced analysis.
46
Create Alert Rules
Entra Portal
If using Log Analytics:
Navigate to: Azure Portal Monitor Alerts Create alert rule
Example: Alert on Global Admin role assignment
Condition:
- Signal type: Custom log search
- Search query:
AuditLogs
| where OperationName == "Add member to role"
| where TargetResources[0].displayName == "Global Administrator"
Actions:
- Action group: Email security team
- Severity: 0 - Critical
Alternative without Log Analytics:
Use Microsoft Sentinel playbooks or
Azure Automation for custom alerting.
Key events to alert on:
- Global Admin role changes
- Conditional Access policy changes
- New application consents
- High-risk sign-ins
- Bulk user modifications
Module 8 Complete!
You've mastered Entra ID monitoring and audit logs. Review the security section next.
Entra ID Security Vulnerabilities & Best Practices
Entra ID is a high-value target for attackers because it's the gateway to Microsoft 365, Azure, and connected applications. Understanding common attack patterns helps you design better defenses.
CRITICAL
Illicit Consent Grant (OAuth Phishing)
Attacker tricks user into granting permissions to malicious app, gaining access to data via API.
Mitigation
Restrict user consent to verified publishers
Require admin consent for all apps
Monitor for suspicious app consent events
Review existing app permissions regularly
CRITICAL
Password Spray Attacks
Attacker tries common passwords against many accounts, evading lockout policies.
Mitigation
Enable MFA for all users
Block legacy authentication
Use Azure AD Password Protection
Monitor for distributed failed sign-ins
HIGH
Privilege Escalation via App Permissions
App with excessive Graph API permissions can read/modify directory objects beyond intended scope.
Mitigation
Follow least privilege for app permissions
Use delegated permissions over application
Regular app permission reviews
Alert on high-privilege permission grants
HIGH
Conditional Access Bypass
Attackers exploit gaps in CA policies (unprotected apps, legacy auth, excluded users).
Mitigation
Apply CA to ALL cloud apps
Minimize exclusions (document all)
Block legacy authentication
Use Report-only to find gaps
HIGH
Standing Privilege Abuse
Permanent admin accounts are compromised, granting immediate elevated access.
Mitigation
Use PIM for all privileged roles
Require MFA and approval for activation
Implement access reviews
Maintain break-glass accounts securely
MEDIUM
Token Theft and Replay
Stolen session tokens can be replayed from different locations/devices.
Mitigation
Enable Continuous Access Evaluation (CAE)
Reduce token lifetimes
Require compliant devices
Monitor for token replay patterns
Entra ID Security Best Practices
Enable Security Defaults or comprehensive Conditional Access
Require MFA for ALL users (no exceptions)
Block legacy authentication protocols
Use PIM for all privileged roles (eliminate standing access)
Implement Identity Protection risk policies
Maintain 2+ break-glass accounts (excluded from CA, secured)
Restrict user consent for applications
Enable audit logging to Log Analytics/SIEM
Conduct regular access reviews for privileged roles
Use Conditional Access "All cloud apps" coverage
Monitor risky sign-ins and users daily
Document all CA policy exclusions with justification
Emergency Access (Break-Glass) Accounts
Always maintain at least 2 emergency access accounts:
Cloud-only accounts (not synced from AD)
Excluded from ALL Conditional Access policies
No MFA (or hardware token stored in safe)
Complex, long passwords stored securely
Monitor for any sign-in with alerts
Test quarterly to ensure they work
Key Takeaways
You've completed a comprehensive Entra ID implementation covering enterprise identity, application SSO, Zero Trust policies, and privileged access management.
Skills Mastered
Tenant Administration: Configure Entra ID settings, users, groups
Application SSO: SAML and OIDC single sign-on configuration
Conditional Access: Zero Trust policies with multiple signals
PIM: Just-in-time privileged access with approvals