1. Home
  2. Learning paths

Privileged Access Defender

Protect the accounts attackers want most, across Linux, Active Directory and Entra ID.

Level Intermediate Steps 8, including 6 labs Time about 9 hours

The steps

  1. GuideBeginner20 min
    PAM Foundations

    PAM basics explained: what counts as privileged, the attack path, vaulting, rotation, session brokering, just-in-time access and the enterprise access model.

    The concepts behind every lab in this path.

    Open the guide →
  2. LabBeginner60 min
    Least Privilege on Linux with sudo: Rules, Logging and Review

    Replace blanket sudo ALL access on Linux with command-specific rules, log every privileged command, record sessions and audit who can run what.

    A quick win on any Linux server.

    Open the lab →
  3. LabIntermediate75 min
    Audit Privileged Groups and AdminSDHolder in Active Directory

    Use PowerShell to list every member of Domain Admins and other privileged AD groups, find stale admins and orphaned adminCount accounts, and clean them up.

    Know who your administrators are.

    Open the lab →
  4. LabIntermediate90 min
    Deploy Windows LAPS for Local Administrator Passwords

    Deploy Windows LAPS in Active Directory: extend the schema, set permissions, configure Group Policy, retrieve a password and prove that it rotates.

    Open the lab →
  5. LabAdvanced120 min
    Build a Tiered Admin Model in Active Directory

    Build a three tier admin model in Active Directory with separate admin accounts, an OU structure and Group Policy logon restrictions, then test that it holds.

    The advanced lab in this path.

    Open the lab →
  6. GuideIntermediate18 min
    IDAM and PIM Foundations

    Identity governance explained: the joiner, mover, leaver lifecycle, access reviews, access packages and Entra Privileged Identity Management (PIM).

    Open the guide →
  7. LabAdvanced110 min
    PIM and JIT Access

    Replace standing admin rights with role eligibility, approval workflows and time-bound elevation.

    Just-in-time access for cloud roles.

    Open the lab →
  8. LabBeginner75 min
    Emergency Access Accounts: Build, Alert and Drill

    Create two emergency access accounts in Entra ID, protect them with passkeys, alert on every sign-in and run a recovery drill you can show an auditor.

    Open the lab →

Other learning paths

Beginner pathIdentity Security StarterNew to identity security? Learn the ideas, set up a tenant and complete your first five labs.7 steps5 labsAbout 8 hoursStart this path →Intermediate pathEntra ID Security EngineerThe full twelve lab track: authenticate, govern privilege, then detect and report.15 steps12 labsAbout 22 hoursStart this path →Advanced pathActive Directory HardeningClose the classic attack routes in an on-premises domain, one lab at a time.6 steps5 labsAbout 9 hoursStart this path →