The steps
-
GuideBeginner60 minLab Prerequisites
What to know and install before the Entra ID labs: a knowledge matrix, tenant and PowerShell 7 setup, a Graph SDK refresher, a glossary and a self-check.
-
LabIntermediate90 minIdentity Risk Baseline
Produce a Graph PowerShell baseline covering MFA coverage, privileged roles, dormant accounts and SMS reliance.
-
LabIntermediate75 minMove Off SMS
Plan and validate a controlled migration from SMS to Microsoft Authenticator without locking anyone out.
-
LabAdvanced120 minConditional Access MFA
Stage, test in report-only and then enforce MFA policies safely, with break-glass exclusions first.
-
LabAdvanced120 minFIDO2 and Passwordless
Roll out phishing-resistant authentication methods to your highest-risk directory roles.
-
GuideIntermediate18 minIDAM and PIM Foundations
Identity governance explained: the joiner, mover, leaver lifecycle, access reviews, access packages and Entra Privileged Identity Management (PIM).
Read before the lifecycle and privilege labs.
-
LabIntermediate90 minSSPR and Domain Risk
Protect the account recovery path and the tenant's domain trust surface with SSPR and domain hygiene.
-
LabAdvanced120 minAutomated Disablement
Build dry-run-first automation that disables accounts that never registered MFA, with circuit breakers.
-
LabAdvanced110 minPIM and JIT Access
Replace standing admin rights with role eligibility, approval workflows and time-bound elevation.
-
LabIntermediate100 minAccess Reviews
Keep guest and privileged access accountable through recurring, evidence-producing reviews.
-
LabAdvanced120 minHybrid Identity Hardening
Protect the bridge between on-premises Active Directory and Entra ID, the most abused identity path.
-
LabIntermediate100 minDefender Identity Protection
Connect Entra risk signals to a repeatable, documented response instead of an inbox full of alerts.
-
LabIntermediate110 minPowerShell Reporting
Turn one-off assessments into a reusable module and scheduled evidence packs for auditors.
-
LabIntermediate100 minRoadmap and Secure Score
Turn twelve labs of results into a prioritised, board-ready identity security roadmap.
-
GuideIntermediate15 minBest Practices
An interactive, prioritised checklist of 38 Entra ID security best practices: authentication, Conditional Access, privileged access, governance and monitoring.
Use the checklist to confirm nothing was missed.
Other learning paths
Beginner pathIdentity Security StarterNew to identity security? Learn the ideas, set up a tenant and complete your first five labs.7 steps5 labsAbout 8 hoursStart this path →
Intermediate pathPrivileged Access DefenderProtect the accounts attackers want most, across Linux, Active Directory and Entra ID.8 steps6 labsAbout 9 hoursStart this path →
Advanced pathActive Directory HardeningClose the classic attack routes in an on-premises domain, one lab at a time.6 steps5 labsAbout 9 hoursStart this path →