These labs cover KQL in Microsoft Entra ID. Work through them in the order shown. Each one lists its prerequisites, the PowerShell you will run, and how to check the change worked.
New to the topic? Read the lab prerequisites and IAM Foundations first.
About KQL labs
How many KQL labs are there?
There is 1 KQL lab on Identity Bytes Labs, taking about 1.5 hours in total.
Where should I start with KQL?
Start with "Hunt Identity Attacks in Sign-in Logs with KQL". Send Entra sign-in logs to Log Analytics and write KQL queries that find password spray, legacy authentication, MFA fatigue and risky new locations.
Do I need a production tenant?
No. Every lab is designed for a free, disposable Microsoft Entra test tenant. Never run lab steps against an environment people depend on.