Microsoft Identity and Access Administrator

People, devices and guests all need identities that are easy to manage and easy to remove. You create users in bulk, build dynamic and assigned groups, join and register devices, and invite partners with controlled access.

• Creating and managing users, including bulk operations
• Assigned and dynamic groups, and group-based licensing
• Joining and registering devices
• Inviting guests and setting cross-tenant access
• Guest lifecycle and cleanup

You build A tenant populated with users, dynamic groups, a registered device and a governed guest account.

Most organizations still have an on-premises directory. You choose between Connect Sync and Cloud Sync, pick a sign-in method, and learn to read synchronization errors before users report them.

• Connect Sync and Cloud Sync compared
• Password hash sync, pass-through authentication and federation
• Filtering what synchronizes
• Writeback and its uses
• Diagnosing synchronization errors

You build A hybrid identity design that names the sync tool, sign-in method and monitoring approach, with reasons.

Passwords are the weakest link, and the methods around them decide how strong sign-in really is. You plan multifactor, passkeys and self-service reset, and set strength requirements for sensitive actions.

• Authentication methods and registration policy
• Multifactor authentication and the Authenticator app
• Passkeys (FIDO2) and Windows Hello for Business
• Temporary Access Pass for onboarding and recovery
• Password protection and self-service reset
• Authentication strengths

You build An authentication rollout plan that moves a group from passwords to passkeys, with a recovery path.

Conditional Access turns signals into decisions: who, from where, on what device, for which app. You write policies, test them in report-only mode, and avoid the mistake that locks everyone out.

• Signals, conditions and grant controls
• Named locations and device-based conditions
• Session controls and continuous access evaluation
• Report-only mode and the What If tool
• Policy design: baselines, exclusions and break-glass accounts
• Reading Conditional Access in sign-in logs

You build A baseline set of Conditional Access policies, tested in report-only mode against sample sign-ins.

Not every sign-in deserves the same trust. You read user and sign-in risk, set policies that respond to it, and work through risky users to find which are compromised and which are false alarms.

• User risk and sign-in risk explained
• Risk-based policies for MFA and password change
• Investigating risky users and sign-ins
• Remediating and dismissing risk
• Feeding risk signals to other tools

You build A risk response procedure with policies and a triage checklist for risky users.

Network access is moving under identity control. You deploy Global Secure Access to route traffic through Entra, publish private resources, and apply policies that follow the user instead of the office network.

• What Global Secure Access replaces and extends
• Traffic forwarding profiles and the client
• Private access to internal applications
• Internet and Microsoft 365 access policies
• Monitoring network traffic logs

You build A Global Secure Access pilot that gives one group private access to an internal app.

Applications and services need identities too, and leaked secrets are a common way in. You choose between managed identities and service principals, register apps, and manage permissions, certificates and consent.

• Managed identities for Azure resources
• App registrations and service principals
• Delegated and application permissions
• Admin consent and consent policies
• Certificates, secrets and federated credentials

You build An app registration with scoped permissions and a managed identity replacing a stored secret.

Every connected app is a door. You integrate gallery and custom apps with single sign-on, publish on-premises apps with Application Proxy, and watch app access and risky OAuth grants in Defender for Cloud Apps.

• Single sign-on with SAML and OpenID Connect
• Gallery and custom enterprise applications
• Automatic user provisioning to apps
• Application Proxy for on-premises apps
• App discovery and OAuth app governance in Defender for Cloud Apps

You build Two apps integrated with single sign-on, one of them published through Application Proxy.

Access granted once tends to stay forever. You bundle resources into access packages with approval and expiry, and run access reviews that remove what people no longer need.

• Catalogs, access packages and policies
• Approval workflows and expiry
• Terms of use and connected organizations
• Access reviews for groups, apps and guests
• Lifecycle workflows for joiners and leavers

You build An access package with approval and expiry, plus a recurring review for the group it feeds.

Standing admin rights are the prize attackers want. You make roles eligible instead of permanent, require approval and justification, and review who holds privilege and how it is used.

• Eligible and active assignments
• Activation rules: approval, MFA and justification
• Access reviews for privileged roles
• PIM for groups and Azure resources
• PIM alerts and audit history

You build A PIM configuration that converts permanent admin roles to eligible ones, with approval rules and reviews.

You cannot protect what you cannot see. You read sign-in and audit logs, send them to Log Analytics, query them with KQL, build workbooks, and track progress with Identity Secure Score.

• Sign-in logs and audit logs
• Diagnostic settings and Log Analytics
• KQL queries for identity events
• Workbooks and dashboards
• Identity Secure Score recommendations

You build An identity monitoring workbook with queries for failed sign-ins, role changes and risky users.

One company scenario draws on everything. You design hybrid identity, sign-in policy, app access and governance for it, implement the key parts in a lab tenant, and justify the trade-offs.

• Reading the company’s requirements and constraints
• Designing tenant, hybrid identity and authentication
• Writing Conditional Access and governance policies
• Securing workloads and apps
• Reviewing the design against Zero Trust

You build A complete identity architecture with a working lab implementation of its core policies.