These labs cover Sentinel in Microsoft Entra ID. Work through them in the order shown. Each one lists its prerequisites, the PowerShell you will run, and how to check the change worked.
New to the topic? Read the lab prerequisites and IAM Foundations first.
About Sentinel labs
How many Sentinel labs are there?
There is 1 Sentinel lab on Identity Bytes Labs, taking about 1.5 hours in total.
Where should I start with Sentinel?
Start with "Hunt Identity Attacks in Sign-in Logs with KQL". Send Entra sign-in logs to Log Analytics and write KQL queries that find password spray, legacy authentication, MFA fatigue and risky new locations.
Do I need a production tenant?
No. Every lab is designed for a free, disposable Microsoft Entra test tenant. Never run lab steps against an environment people depend on.