This course develops the knowledge and skills needed to implement and manage identity and access solutions using Microsoft Entra ID. It focuses on cloud identity administration, multifactor authentication (MFA), single sign-on (SSO), Conditional Access, application access, privileged identity management, and identity governance.
Participants learn to secure access for users, external collaborators, applications, and workloads; support hybrid identity environments; and monitor and troubleshoot identity services using Zero Trust principles.
Duration 4 Days – 28 hrs.
Objectives
- Configure and administer Microsoft Entra ID tenants, users, groups, devices, and administrative roles.
- Manage external collaboration and explain hybrid identity synchronization options.
- Implement MFA, passwordless authentication, and self-service password reset.
- Configure Conditional Access policies to secure access across users, applications, and devices.
- Investigate and respond to identity risks using Microsoft Entra ID Protection.
- Integrate enterprise applications and configure SSO, provisioning, and application permissions.
- Manage application registrations, service principals, and managed identities.
- Configure Privileged Identity Management (PIM) to support least-privilege access.
- Implement entitlement management, access reviews, and identity lifecycle controls.
- Monitor and troubleshoot identity and access services using logs, reports, and security insights.
Target Audience
- Cloud administrators responsible for identity and access services.
- Azure administrators managing access to cloud resources and applications.
- Cybersecurity professionals implementing identity security controls.
- Identity and Access Management (IAM) specialists.
- Microsoft 365 administrators supporting Microsoft Entra ID environments.
- IT administrators and engineers preparing for the SC-300 certification.
Prerequisites
- Working knowledge of Microsoft Azure and Microsoft 365 services.
- Familiarity with Active Directory Domain Services and basic directory concepts.
- Understanding of authentication, authorization, role-based access control, and least privilege.
- Basic knowledge of networking, cloud computing, and security principles.
- Familiarity with PowerShell and basic Kusto Query Language (KQL) concepts.
- Foundational knowledge equivalent to SC-900 and AZ-900; certification is not required.
Course Outline
Day 1: Identity Administration and Hybrid Identity
Module 1: Microsoft Entra ID and Identity Security Foundations
- Identity and access management concepts.
- Microsoft Entra capabilities and tenant architecture.
- Zero Trust principles and identity security.
- Microsoft Entra roles and Azure role-based access control.
- Licensing considerations for identity and governance features.
Module 2: Manage Tenants, Users, Groups, and Devices
- Tenant properties, domains, and organizational branding.
- User creation, configuration, and bulk administration.
- Group types, membership, and dynamic membership rules.
- License assignment and custom security attributes.
- Device registration and Microsoft Entra join.
- Administrative units and delegated administration.
Module 3: External Collaboration and Hybrid Identity
- Guest users and external collaboration settings.
- Cross-tenant access and synchronization.
- Microsoft Entra Connect Sync and Cloud Sync.
- Password hash synchronization and pass-through authentication.
- Seamless SSO and federation considerations.
- Synchronization health and troubleshooting.
Day 2: Authentication and Secure Access
Module 4: Implement and Manage User Authentication
- Authentication methods and registration policies.
- MFA deployment and user registration.
- Microsoft Authenticator, passkeys, and passwordless authentication.
- Temporary Access Pass and certificate-based authentication.
- Windows Hello for Business concepts.
- Self-service password reset and password protection.
- Session revocation and account recovery.
Module 5: Plan and Implement Conditional Access
- Policy planning, assignments, conditions, and exclusions.
- Grant controls, authentication strengths, and session controls.
- Device-based access requirements.
- Report-only mode and the What If tool.
- Continuous access evaluation and authentication context.
- Policy troubleshooting and emergency access considerations.
Module 6: Identity Protection and Global Secure Access
- User risk and sign-in risk.
- Risk-based access policies and remediation.
- Investigation of risky users, sign-ins, and workload identities.
- Microsoft Entra Internet Access and Private Access concepts.
- Global Secure Access clients and traffic profiles.
Day 3: Application Access and Workload Identities
Module 7: Enterprise Applications and Single Sign-On
- Enterprise applications and application integration.
- SAML, OpenID Connect, and OAuth 2.0 concepts.
- SSO configuration for software-as-a-service applications.
- User, group, and application role assignments.
- Application provisioning and deprovisioning.
- Microsoft Entra Application Proxy for on-premises applications.
- Application collections and user access experiences.
Module 8: App Registrations and Workload Identities
- App registrations and service principals.
- Application authentication and credential management.
- Delegated and application permissions.
- User consent and administrator consent.
- Application roles and API access.
- System-assigned and user-assigned managed identities.
- Workload identity security considerations.
Module 9: Monitor and Control Application Access
- Application sign-in and provisioning logs.
- Troubleshooting SSO, consent, and provisioning issues.
- Microsoft Defender for Cloud Apps integration.
- Cloud discovery and connected applications.
- Conditional Access app control.
- Application access, session, and OAuth application policies.
Day 4: Privileged Access and Identity Governance
Module 10: Implement Privileged Identity Management
- Least privilege and just-in-time administrative access.
- Eligible and active role assignments.
- PIM for Microsoft Entra roles and Azure resources.
- PIM for Groups.
- Activation requirements, approvals, and notifications.
- Privileged access history and reporting.
- Emergency access accounts.
Module 11: Implement Identity Governance
- Entitlement management and connected organizations.
- Catalogs, access packages, and access request policies.
- Approval workflows, expiration, and terms of use.
- Access reviews for groups, applications, and privileged roles.
- External user access lifecycle management.
- Joiner, mover, and leaver processes.
- Lifecycle workflow concepts and automation opportunities.
Module 12: Identity Monitoring and Troubleshooting
- Sign-in, audit, and provisioning logs.
- Diagnostic settings and Log Analytics integration.
- Basic KQL queries for identity investigations.
- Workbooks and identity reporting.
- Identity Secure Score and security improvement actions.
- Troubleshooting authentication, access, and governance issues.
Module 13: Capstone — Secure an Organization’s Identity Environment
- Configure users, groups, and delegated administrative access for a sample organization.
- Establish MFA and Conditional Access policies with emergency access provisions.
- Integrate an enterprise application with SSO and appropriate access assignments.
- Configure privileged role eligibility and activation requirements.
- Create an access package and recurring access review.
- Investigate identity logs and document the resulting access configuration.

