A hands-on Microsoft Entra ID lab demonstrating identity lifecycle management, security group administration, role-based access control, Microsoft Authenticator registration, authentication log analysis, and security auditing. The project includes documented security findings, least-privilege access practices, and an assessment of identity protection capabilities and licensing limitations.
Microsoft Entra ID | Identity & Access Management Security Lab is a hands-on cybersecurity project focused on understanding how organizations manage digital identities, control access to resources, and investigate authentication activity.
I created a simulated organizational environment for KCG Technology using Microsoft Entra ID. Through this lab, I gained practical experience administering user accounts, organizing security groups, managing privileged directory roles, registering authentication methods, and reviewing identity-related security logs.
The project also explored foundational identity security practices, including the principle of least privilege, multi-factor authentication, and security auditing. Working within a Microsoft Entra ID Free tenant provided an opportunity to evaluate available security controls and understand the licensing requirements for more advanced identity protection capabilities.
My goal was to strengthen my practical Identity and Access Management skills while documenting the technical processes, investigative findings, and lessons learned throughout the project.
To document and showcase this project, I created a dedicated GitHub repository containing a structured README, a detailed technical walkthrough, and supporting evidence from the lab. This provided a centralized location for organizing the project, documenting investigative findings, and making the completed work accessible to recruiters and other technical professionals.
Organizations must manage user identities, control access to sensitive resources, and maintain visibility into authentication activity. Improperly assigned privileges, weak authentication controls, and insufficient monitoring can increase the risk of unauthorized access and make security investigations more difficult.
I wanted to better understand how these challenges are addressed in a real identity management platform. Rather than relying solely on theoretical knowledge, I needed a controlled environment where I could practice administering identities, assigning and revoking privileges, and investigating security events through actual administrative logs.
A key challenge was distinguishing between security controls that were configured and those that could be verified as enforced. For example, successfully registering Microsoft Authenticator does not necessarily demonstrate that multi-factor authentication was required during a sign-in that followed.
The lab also presented licensing limitations. Because the environment used Microsoft Entra ID Free, advanced capabilities such as premium Conditional Access policies and Privileged Identity Management were not unavailable. This required me to evaluate the security controls accessible within the tenant while documenting areas that would require additional licensing or validation.
I approached this project as a structured Identity and Access Management (IAM) lab, advancing from identity administration to access control, authentication configuration, and security investigation.
Identity and Security Group Administration
I created test user accounts representing IT, Human Resources, and Finance personnel within a simulated KCG Technology organization. I organized these identities into department-specific Microsoft Entra security groups to practice centralized access management.
Role-Based Access Control (RBAC)
I practiced privileged access administration by temporarily assigning the Password Administrator directory role to an IT test account. After completing the exercise, I revoked the role and verified the removal, reinforcing the principle of least privilege.
Audit Log Investigation
I used Microsoft Entra Audit Logs to investigate directory changes, including privileged role assignments and removals. Then, I reviewed event details and modified properties to confirm that administrative actions were recorded successfully.
Authentication Configuration
I reviewed Microsoft Authenticator authentication settings, including number matching, and successfully registered the application for a test identity. I also confirmed that Security Defaults were enabled in the tenant.
Sign-in Log Analysis
I examined interactive and non-interactive sign-in activity using Microsoft Entra Sign-in Logs. During the investigation, I identified a successful sign-in that recorded single-factor authentication, highlighting the importance of validating authentication enforcement instead of only relying on configuration settings.
Security Assessment and Documentation
I evaluated the tenant's Microsoft Entra ID Free licensing and identified limitations affecting advanced identity security capabilities, including premium Conditional Access policies.
I documented a security observation, KCG-IAM-001, concerning the need to validate MFA enforcement. The finding remains open pending a controlled authentication test and additional sign-in log review.
GitHub Repository and Technical Documentation
To organize and present the completed lab, I created a dedicated GitHub repository for the Microsoft Entra ID security project. I developed a structured README summarizing the project objectives, technologies, key accomplishments, and documented security finding.
I also created a detailed technical walkthrough covering the lab exercises, investigation procedures, security assessments, and lessons learned. Supporting screenshots were organized and linked to the documentation to provide visual evidence of the completed activities.
After uploading the documentation to GitHub, I reviewed the repository and verified that the technical walkthrough and supporting evidence links were accessible. This established a centralized, publicly accessible record of the project's implementation and findings.
Through this project, I successfully completed a series of hands-on Identity and Access Management exercises using Microsoft Entra ID. The lab strengthened my ability to administer identities, manage privileged access, investigate authentication activity, and evaluate security controls.
Key Accomplishments
Security Finding: KCG-IAM-001
During my investigation, I identified a successful sign-in that recorded single-factor authentication, in spite of Microsoft Authenticator being registered for the test identity and Security Defaults being enabled.
This observation didn't establish a security breach or prove that MFA enforcement was misconfigured. However, it did demonstrate that authentication registration and security configuration alone aren't sufficient evidence of MFA enforcement.
I documented the finding as Low Severity, with a status of Open, Pending Validation. The recommended next step is to perform a controlled authentication test and review the resulting sign-in records to determine whether an MFA challenge occurs under the applicable conditions.
This project reinforced the importance of applying the principle of least privilege when managing privileged access. Temporarily assigning and revoking administrative roles demonstrated why elevated permissions should only remain active when necessary.
Investigating Microsoft Entra Audit Logs strengthened my understanding of how administrative changes can be verified through recorded evidence.
One of my most important lessons was recognizing that registering Microsoft Authenticator and enabling Security Defaults do not automatically prove that multifactor authentication was required during a specific sign-in. Actual authentication results must be evaluated through sign-in records.
Working within Microsoft Entra ID Free also helped me understand how licensing affects available security capabilities and why technical assessments must distinguish between implemented controls and features requiring additional licensing.
Above all, this lab strengthened my ability to investigate security observations, document findings accurately, and recommend validation steps without making unsupported assumptions.
Documenting this project through GitHub reinforced the importance of maintaining organized, accessible, and verifiable technical records. Creating a structured README, detailed walkthrough, and supporting evidence helped me understand how clear documentation can communicate technical work, support future troubleshooting, and demonstrate completed security activities to others.
The next priority is to conduct a controlled MFA sign-in test using the registered Microsoft Entra ID test account. I plan to review the resulting Sign-in Logs and Authentication Details to determine whether an MFA challenge was required and successfully completed.
Based on the verified results, I'll update security finding KCG-IAM-001, including its validation status, supporting evidence, and any necessary recommendations.
Future lab improvements might include exploring Microsoft Entra Conditional Access policies, Privileged Identity Management (PIM), Identity Protection, and Access Reviews if appropriate premium licensing becomes available.
I also plan to continue expanding my identity security investigation skills through additional authentication scenarios, administrative access reviews, and evidence-based security assessments.
