These labs cover Service accounts in Microsoft Entra ID. Work through them in the order shown. Each one lists its prerequisites, the PowerShell you will run, and how to check the change worked.
New to the topic? Read the lab prerequisites and IAM Foundations first.
NewIB-AD-SECFind Kerberoastable Service Accounts and Move Them to gMSAFind Kerberoastable service accounts in Active Directory with PowerShell, rank them by risk, then replace one with a group Managed Service Account (gMSA).Intermediate100 minNewIB-WORKLOADAudit App Registration Secrets and Certificates in Entra IDUse Microsoft Graph PowerShell to find expired, long-lived and ownerless app registration secrets in Entra ID, then fix them and set a lifetime policy.Intermediate90 min
About Service accounts labs
How many Service accounts labs are there?
There are 2 Service accounts labs on Identity Bytes Labs, taking about 3.2 hours in total.
Where should I start with Service accounts?
Start with "Find Kerberoastable Service Accounts and Move Them to gMSA". Find Kerberoastable service accounts in Active Directory with PowerShell, rank them by risk, then replace one with a group Managed Service Account (gMSA).
Do I need a production tenant?
No. Every lab is designed for a free, disposable Microsoft Entra test tenant. Never run lab steps against an environment people depend on.