Identity Architect (self-directed lab)
Enterprise Entra ID Lab
A full-fidelity Entra ID tenant modeling enterprise identity: hybrid sync, Conditional Access, PIM, and break-glass procedures.
Architecture
Overview
Built a production-grade Entra ID lab tenant emulating a 5,000-seat enterprise. The lab models user lifecycle from joiner-mover-leaver through entitlement management, with Conditional Access as the policy enforcement plane.
Hybrid identity is provided by an on-prem domain synced via Entra Connect with password hash sync. Privileged accounts are isolated in a dedicated admin tier and access is brokered exclusively through Privileged Identity Management (PIM).
Key design decisions
- Admin tier model with dedicated cloud-only accounts; no synced privileged identities.
- Conditional Access baseline: MFA for all users, device compliance for resource access, geo-blocking for high-risk regions.
- Break-glass: two cloud-only accounts excluded from CA, alerted on every sign-in via Sentinel.
- Entitlement management for project access, with access reviews every 90 days.
Outcome
- Documented runbooks for joiner-mover-leaver, lost MFA, and break-glass invocation.
- Reusable Terraform module bootstraps the CA policy set in a new tenant in under 10 minutes.