The steps
-
GuideBeginner20 minIAM Foundations
IAM basics explained: authentication versus authorisation, MFA strength, Active Directory versus Entra ID, OAuth, OpenID Connect, SAML and Zero Trust.
Read this first. Every later step uses these terms.
-
GuideBeginner60 minLab Prerequisites
What to know and install before the Entra ID labs: a knowledge matrix, tenant and PowerShell 7 setup, a Graph SDK refresher, a glossary and a self-check.
Set up your tenant and tools, then take the self-check.
-
LabBeginner60 minBlock Legacy Authentication with Conditional Access
Find who still uses legacy authentication in Entra ID, then block it safely with a report-only Conditional Access policy before you enforce it.
Your first Conditional Access policy.
-
LabBeginner75 minEmergency Access Accounts: Build, Alert and Drill
Create two emergency access accounts in Entra ID, protect them with passkeys, alert on every sign-in and run a recovery drill you can show an auditor.
Do this before any stricter policy.
-
LabIntermediate90 minIdentity Risk Baseline
Produce a Graph PowerShell baseline covering MFA coverage, privileged roles, dormant accounts and SMS reliance.
Measure the tenant so you can show improvement.
-
LabIntermediate75 minMove Off SMS
Plan and validate a controlled migration from SMS to Microsoft Authenticator without locking anyone out.
-
LabAdvanced120 minConditional Access MFA
Stage, test in report-only and then enforce MFA policies safely, with break-glass exclusions first.
The first advanced lab. Take your time.
Other learning paths
Intermediate pathEntra ID Security EngineerThe full twelve lab track: authenticate, govern privilege, then detect and report.15 steps12 labsAbout 22 hoursStart this path →
Intermediate pathPrivileged Access DefenderProtect the accounts attackers want most, across Linux, Active Directory and Entra ID.8 steps6 labsAbout 9 hoursStart this path →
Advanced pathActive Directory HardeningClose the classic attack routes in an on-premises domain, one lab at a time.6 steps5 labsAbout 9 hoursStart this path →