These labs cover Monitoring in Microsoft Entra ID. Work through them in the order shown. Each one lists its prerequisites, the PowerShell you will run, and how to check the change worked.
New to the topic? Read the lab prerequisites and IAM Foundations first.
NewIB-DETECTHunt Identity Attacks in Sign-in Logs with KQLSend Entra sign-in logs to Log Analytics and write KQL queries that find password spray, legacy authentication, MFA fatigue and risky new locations.Intermediate90 minNewIB-ENTRA-STARTEmergency Access Accounts: Build, Alert and DrillCreate two emergency access accounts in Entra ID, protect them with passkeys, alert on every sign-in and run a recovery drill you can show an auditor.Beginner75 min
About Monitoring labs
How many Monitoring labs are there?
There are 2 Monitoring labs on Identity Bytes Labs, taking about 2.8 hours in total.
Where should I start with Monitoring?
Start with "Hunt Identity Attacks in Sign-in Logs with KQL". Send Entra sign-in logs to Log Analytics and write KQL queries that find password spray, legacy authentication, MFA fatigue and risky new locations.
Do I need a production tenant?
No. Every lab is designed for a free, disposable Microsoft Entra test tenant. Never run lab steps against an environment people depend on.