Entra ID Identity and Access Management

What Entra ID Identity and Access Management teaches: operationalize a governed identity program where every identity, human and machine, has an owner, a lifecycle, and compliance evidence, using Entra ID Governance, entitlement management, access reviews, and PIM. The lifecycle you'll govern, the program and ADRs you walk away with, and how the course is structured. Start here.

The foundation every subsequent module builds on. Identity types as governance objects, the data model that drives lifecycle automation, data quality as a governance prerequisite, group architecture as the access assignment mechanism, administrative units and delegation boundaries, licensing for governance features, and a full governance state assessment with the first ADRs and risk register entries.

The operational foundation. How user identities work in Entra ID, the object model, creation process, attributes, extension mechanisms, password policies, authentication method registration, lifecycle states, external identities, and production-scale management. You can't automate what you don't understand manually.

Groups are the access assignment mechanism in Entra ID. This module teaches how to design, implement, and govern a group architecture that maps organizational structure to access policy, dynamic groups for automated membership, role-based access for administrative delegation, and governance controls that prevent the sprawl most tenants already have.

Authentication is how identities prove who they are. This module teaches how to design, implement, and govern an authentication architecture, from MFA registration through passwordless deployment to authentication strength policies that tie method selection to access tiers. You build the authentication layer that Module 5's Conditional Access policies will enforce.

Conditional Access is the access policy engine that enforces every authentication and access decision in your tenant. This module teaches how to design, implement, and govern a Conditional Access architecture, from policy structure and risk-based evaluation through session management to the governance cadences that prevent policy sprawl. You build the access control layer that connects Module 4's authentication strengths to the resources they protect.

Application access as an identity discipline rather than an app problem: OAuth consent fundamentals, consent policy design, reviewing what has already been granted, and governing the service principals that hold permissions nobody reviews.

Build a governance framework for the non-human identities that outnumber your users, hold broader permissions, and operate without any of the controls you built in Modules 1–6.

Govern the identities that have no credentials to steal, no passwords to rotate, and no human to blame, managed identities, workload identity federation, and the AI agents that are accumulating permissions in your tenant right now.

How privileged access is governed and who manages the governance. PIM design, role governance, emergency access, administrative units, scoped roles, and delegation architecture, taught together because they're operationally inseparable.

How identities are provisioned, moved, and deprovisioned across your M365 environment. Inbound provisioning architecture, lifecycle workflows for joiner-mover-leaver automation, guest identity lifecycle, custom workflow extensions, provisioning monitoring, and tenant-level governance configuration.

The access request engine: catalog architecture, access package design, approval workflows, and the lifecycle policies that expire access without anybody having to remember.

Why access reviews fail, and the design that stops them rubber-stamping: scope and targeting, choosing reviewers and cadence, automation and recommendations, and acting on the outcome.

Identity monitoring as an IAM function rather than a SOC one: stale identities, permission creep, credential health, and the evidence a compliance conversation actually needs.

Assembling the program: coherence across every control built so far, the risk register, the architecture decision portfolio, and the deliverable that survives your departure.

The commands and queries behind every IAM domain in the course, with what each answer decides and what it leaves open.

Ordered procedures for the identity work that recurs: onboarding at scale, offboarding properly, tightening consent, and cleaning up what accumulated.

Building a tenant with a population messy enough to behave like a real directory, where you can break governance safely.

Identity work reasoned end to end, including the cases where the number everybody quoted was wrong and the ones that end in doing nothing.

What to do when something fires or somebody asks: a compromised account, a stalled pipeline, an urgent access request, a departure, an audit.

Every practice surface available for this course, what each one gives you, and where the gaps are.

Microsoft documentation, security frameworks, compliance standards, threat intelligence, and vendor references used throughout the IAM course.

Entra ID Identity and Access Management end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.