← All projects

Identity Architect (self-directed lab)

Enterprise Entra ID Lab

A full-fidelity Entra ID tenant modeling enterprise identity: hybrid sync, Conditional Access, PIM, and break-glass procedures.

  • Entra ID
  • Hybrid AD Connect
  • Conditional Access
  • PIM
  • MFA
  • Intune

Architecture

Entra ID TenantOn-Prem ADActive DirectoryEntra ConnectEntra IDConditional AccessPIMIntune MDMWorkforce UserAdmin UserMicrosoft 365Azure Resources

Overview

Built a production-grade Entra ID lab tenant emulating a 5,000-seat enterprise. The lab models user lifecycle from joiner-mover-leaver through entitlement management, with Conditional Access as the policy enforcement plane.

Hybrid identity is provided by an on-prem domain synced via Entra Connect with password hash sync. Privileged accounts are isolated in a dedicated admin tier and access is brokered exclusively through Privileged Identity Management (PIM).

Key design decisions

  1. Admin tier model with dedicated cloud-only accounts; no synced privileged identities.
  2. Conditional Access baseline: MFA for all users, device compliance for resource access, geo-blocking for high-risk regions.
  3. Break-glass: two cloud-only accounts excluded from CA, alerted on every sign-in via Sentinel.
  4. Entitlement management for project access, with access reviews every 90 days.

Outcome

  1. Documented runbooks for joiner-mover-leaver, lost MFA, and break-glass invocation.
  2. Reusable Terraform module bootstraps the CA policy set in a new tenant in under 10 minutes.