These labs cover PAM in Microsoft Entra ID. Work through them in the order shown. Each one lists its prerequisites, the PowerShell you will run, and how to check the change worked.
New to the topic? Read the lab prerequisites and IAM Foundations first.
NewIB-PAM-CORELeast Privilege on Linux with sudo: Rules, Logging and ReviewReplace blanket sudo ALL access on Linux with command-specific rules, log every privileged command, record sessions and audit who can run what.Beginner60 minNewIB-AD-SECBuild a Tiered Admin Model in Active DirectoryBuild a three tier admin model in Active Directory with separate admin accounts, an OU structure and Group Policy logon restrictions, then test that it holds.Advanced120 minNewIB-AD-SECDeploy Windows LAPS for Local Administrator PasswordsDeploy Windows LAPS in Active Directory: extend the schema, set permissions, configure Group Policy, retrieve a password and prove that it rotates.Intermediate90 minNewIB-AD-SECFind Kerberoastable Service Accounts and Move Them to gMSAFind Kerberoastable service accounts in Active Directory with PowerShell, rank them by risk, then replace one with a group Managed Service Account (gMSA).Intermediate100 minNewIB-AD-SECAudit Privileged Groups and AdminSDHolder in Active DirectoryUse PowerShell to list every member of Domain Admins and other privileged AD groups, find stale admins and orphaned adminCount accounts, and clean them up.Intermediate75 min
About PAM labs
How many PAM labs are there?
There are 5 PAM labs on Identity Bytes Labs, taking about 7.4 hours in total.
Where should I start with PAM?
Start with "Least Privilege on Linux with sudo: Rules, Logging and Review". Replace blanket sudo ALL access on Linux with command-specific rules, log every privileged command, record sessions and audit who can run what.
Do I need a production tenant?
No. Every lab is designed for a free, disposable Microsoft Entra test tenant. Never run lab steps against an environment people depend on.