Entra ID Security

What Entra ID Security teaches: engineer Entra ID into the perimeter that stops account takeover, MFA fatigue, and token theft, using Conditional Access, Identity Protection, PIM, and token security. The identity control plane you'll work, the policies and detections you walk away with, and how the course is structured. Start here.

The sign-in log is the single most important data source for identity security. Every field explained in security context. Interactive, non-interactive, and service principal authentication. Authentication details, conditional access evaluation, risk signals, device and location context. KQL query patterns for identity data. Cross-table correlation. Building a sign-in baseline that makes anomaly detection and policy verification possible.

Every identity attack either exploits weak authentication or bypasses strong authentication. The full authentication method hierarchy, from passwords to phishing-resistant credentials. Microsoft Authenticator configuration and security. FIDO2 security keys and passkeys. Certificate-based authentication. Planning and deploying phishing-resistant authentication across your organization.

How to design a conditional access architecture that stops attacks without breaking productivity. Evaluation engine, Zero Trust policy framework, named locations, device conditions, session controls, and emergency access.

Specific real-world attack techniques and the conditional access policy combinations that stop each one. AiTM, password spray, MFA fatigue, token theft, consent phishing, legacy authentication, and workload identities.

How Identity Protection detects risk, how to configure risk policies, and how to operationalize risk signals for prevention and detection. Risk remediation, risky users investigation, tuning, and conditional access integration.

Just-in-time, just-enough-access for administrative roles. PIM for Entra ID roles and Azure resources, access reviews, monitoring and alerting, and designing a complete privileged access strategy.

Tokens are the currency of identity. Token types and lifecycle, how tokens are stolen, token protection deployment, continuous access evaluation, session lifetime controls, and protecting the Primary Refresh Token.

You deployed conditional access policies. How do you know they work? Report-only mode, What-If simulation, sign-in log policy validation, troubleshooting access failures, and change management.

Application registrations are the most overlooked attack surface in Entra ID. The dual-object model, credential management, permission governance, admin consent workflow, lifecycle security, and detecting malicious application activity.

Subject-area sheets for identity work: where the control lives in the portal, the query that answers the question at scale, and what the answer does not prove.

Seven runbooks for the procedures an identity engineer repeats: deploying a policy, retiring a method, migrating to PIM, onboarding a partner, and getting a tenant back.

A complete build for an identity lab: tenant, workspace, telemetry, a population, a partner tenant, and the checks that prove it works.

Worked identity investigations end to end, including the wrong turns, the queries that looked right and were not, and what would have changed each answer.

Seven configuration and governance events that fire at an identity engineer, each with the clearing check, what escalates it, and how to reverse it.

Where to practice the identity work in this course against real data, without a tenant of your own.

External sources this course draws on: Microsoft Entra documentation, attack research, frameworks and community identity security material.

Entra ID Security end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.