Entra ID Hygiene
Entra ID hygiene literacy covers conditional access, MFA, privileged roles, app registrations, and guest access — identity hardening on YOUR $CLOUD_LAB tenant.
Visual · t31_entra_id_hygiene
Entra ID hygiene literacy. $CLOUD_LAB only. Original Cyberlium.
Azure identity is the control plane — literacy names Entra ID levers before attackers pivot through over-privileged apps in tenants you should protect.
Entra ID (Azure AD) hygiene includes MFA for admins and users, conditional access policies (location, device, risk), Privileged Identity Management just-in-time elevation, limiting app registration permissions, reviewing guest invitations, and disabling legacy auth. Cloud identity breaches often start with password spray or stolen refresh tokens — defender fix is CA and MFA, not stranger tenant enumeration. Cyberlium writes Entra ID hygiene checklist on YOUR $CLOUD_LAB personal tenant — paper design or sandbox toggles within free tier. Next: Sentinel Named.
1. Entra ID controls (named)
Conditional Access: require MFA, block legacy auth, require compliant device for admin roles. PIM: time-bound Global Admin activation with approval. App registration: restrict who can create apps; audit API permissions. Guest users: review external collaboration scope.
On $CLOUD_LAB, write five-item Entra ID hygiene checklist for fictional lab tenant.
Command guide
Try these commands — Entra ID controls (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: Entra ID security (https://learn.microsoft.com/en-us/entra/fundamentals/security-operations-introduction); Conditional Access (https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview); Azure RBAC (https://learn.microsoft.com/en-us/azure/role-based-access-control/overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why identity hygiene parallels AWS IAM literacy
Both clouds: over-privileged principal + weak auth = breach. Entra CA is policy engine; AWS IAM plus IdP federation plays similar role. Multi-cloud analysts translate identity controls across vendors.
Students never test password spray against stranger Entra tenants — lab checklists only.
3. Literacy ≠ stranger tenant identity attacks
Forbidden: user enumeration or password spray on live portals you do not own. Allowed: Entra ID hygiene card — five controls with pass/fail on $CLOUD_LAB.
Ship: Entra ID hygiene checklist for YOUR lab tenant. Next: Sentinel Named.
4. What you ship: Entra ID hygiene checklist for $CLOUD_LAB
Five identity controls with pass/fail on lab tenant. $CLOUD_LAB named. NO stranger attacks. chmod 600.
5. What you record before the next lesson
Date. Entra ID checklist. $CLOUD_LAB named. File t31-m05-l02-entra-id-hygiene.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run password spray on stranger Microsoft login. Grant Global Admin to lab app 'for speed.'
- Right: Write Entra ID hygiene checklist for YOUR $CLOUD_LAB tenant. Next: Sentinel Named.
Mission: harden Entra ID on YOUR lab tenant (paper check)
1) List MFA and CA targets for fictional admins. 2) Note PIM vs standing admin preference. 3) One app registration permission review item. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Block legacy auth before debating advanced CA — low-hanging identity fruit.
APPLY: Conditional Access primarily enforces:
APPLY: True or False: MFA on privileged Entra roles is a baseline hygiene control.
APPLY: Entra ID hygiene literacy on Cyberlium avoids: