The steps
-
GuideBeginner20 minIAM Foundations
IAM basics explained: authentication versus authorisation, MFA strength, Active Directory versus Entra ID, OAuth, OpenID Connect, SAML and Zero Trust.
A refresher on tokens and protocols helps with the log fields.
-
LabIntermediate90 minHunt Identity Attacks in Sign-in Logs with KQL
Send Entra sign-in logs to Log Analytics and write KQL queries that find password spray, legacy authentication, MFA fatigue and risky new locations.
-
LabIntermediate100 minDefender Identity Protection
Connect Entra risk signals to a repeatable, documented response instead of an inbox full of alerts.
-
LabIntermediate80 minLock Down App Consent and Review OAuth Grants in Entra ID
Stop consent phishing in Entra ID: restrict user consent, turn on the admin consent workflow and audit existing OAuth permission grants with Graph PowerShell.
-
LabIntermediate90 minAudit App Registration Secrets and Certificates in Entra ID
Use Microsoft Graph PowerShell to find expired, long-lived and ownerless app registration secrets in Entra ID, then fix them and set a lifetime policy.
-
LabIntermediate110 minPowerShell Reporting
Turn one-off assessments into a reusable module and scheduled evidence packs for auditors.
Other learning paths
Beginner pathIdentity Security StarterNew to identity security? Learn the ideas, set up a tenant and complete your first five labs.7 steps5 labsAbout 8 hoursStart this path →
Intermediate pathEntra ID Security EngineerThe full twelve lab track: authenticate, govern privilege, then detect and report.15 steps12 labsAbout 22 hoursStart this path →
Intermediate pathPrivileged Access DefenderProtect the accounts attackers want most, across Linux, Active Directory and Entra ID.8 steps6 labsAbout 9 hoursStart this path →