Lab prerequisites

What you need to know, lab by lab

You do not need all of this before Lab 01. Use the matrix to see what each lab leans on, and read the matching Foundations guide just before you need it. Click a lab number to open it, or an area to see what it involves.

Set up your lab environment

Everything here uses free accounts or trials. Use a personal, disposable tenant only. The labs make real directory changes.

1. Create a lab tenant

   Sign up for a free Azure account with a personal email address. It creates a Microsoft Entra tenant with an onmicrosoft.com domain and makes you its Global Administrator. Then start a free Microsoft Entra ID P2 trial from the Entra admin centre, which unlocks Conditional Access, ID Protection, PIM and access reviews.

   Lab 10's Defender for Identity section also needs a Microsoft 365 E5 trial.

2. Secure your own admin account

   Register Microsoft Authenticator on your admin account at aka.ms/mysecurityinfo before you build anything. Microsoft requires MFA for the Azure and Entra admin portals.

3. Install PowerShell 7

   The labs target PowerShell 7.4 or later, not Windows PowerShell 5.1. On Windows:

   winget install --id Microsoft.PowerShell --source winget
   # then open "PowerShell 7" and confirm
   $PSVersionTable.PSVersion

   For macOS and Linux, follow Install PowerShell on Microsoft Learn ↗.

4. Install the Microsoft Graph PowerShell SDK

   Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery
   # check it installed
   Get-Module Microsoft.Graph* -ListAvailable | Select-Object Name, Version -First 5

5. Prove you can connect

   Connect-MgGraph -Scopes 'User.Read.All' -NoWelcome
   Get-MgContext | Select-Object Account, TenantId, Scopes
   Get-MgUser -Top 5 | Select-Object DisplayName, UserPrincipalName
   Disconnect-MgGraph

   If this returns your tenant ID and a few users, you are ready for Lab 01.

6. Choose an editor

   Visual Studio Code with the PowerShell extension gives you syntax highlighting, IntelliSense for Graph cmdlets and an integrated terminal.

7. Create an evidence folder

   Every lab exports CSV, JSON or HTML. Keep one dated folder per lab. Those files become your before and after story in Lab 12.

8. Optional extras Optional

   A FIDO2 security key such as a YubiKey for Lab 04 (a platform passkey works for learning). A Windows Server virtual machine promoted to a domain controller if you want to run the on-premises parts of Labs 09 and 10 hands-on.

The patterns every lab uses

If these two blocks read clearly to you, the lab scripts will too.

# Objects flow through the pipeline
$users = Get-MgUser -All -Property id,displayName,accountEnabled
$users |
  Where-Object { $_.AccountEnabled -eq $false } |
  Select-Object DisplayName, Id |
  Export-Csv '.\disabled.csv' -NoTypeInformation

# Count and loop
"Users: $($users.Count)"
foreach ($u in $users) { $u.DisplayName }

# Hashtables become Graph request bodies
$body = @{
  displayName = 'CA001 - Require MFA'
  state       = 'enabledForReportingButNotEnforced'
}

# Handle errors instead of assuming success
try {
  New-MgIdentityConditionalAccessPolicy -BodyParameter $body -ErrorAction Stop
}
catch {
  Write-Warning "Failed: $($_.Exception.Message)"
}

Terms the labs use without stopping to explain

Tenant

Your organisation's dedicated instance of Microsoft Entra ID.

UPN

User principal name, the sign-in name that looks like an email address.

Scope

A named Graph permission such as User.Read.All.

Delegated permission

An app acts as the signed-in user, limited by that user's rights.

Application permission

An app acts as itself, with no user. Usually broader; grant sparingly.

Consent

Approval for an app to use the permissions it asks for.

Service principal

An application's identity inside your tenant.

Managed identity

A service principal for an Azure resource, with no secret to manage.

Conditional Access

The policy engine that decides each sign-in using signals such as user, app, device and risk.

Report-only mode

A policy is evaluated and logged but not enforced.

Authentication strength

A named set of allowed sign-in methods that a policy can require.

Break-glass account

An emergency administrator account kept outside normal controls.

PIM

Privileged Identity Management, Entra's just-in-time role activation feature.

Eligible assignment

Permission to activate a role, without holding it until activation.

Access review

A scheduled check where a reviewer confirms or removes access.

Dry run

Running automation in report mode so it shows what it would change without changing anything.

Self-check: are you ready for Lab 01?

Pick an answer for each question. You see the explanation straight away, with a link to revise if you need it.