Cloud › Module 5 › Lesson 2
Entra ID Hygiene
Entra ID hygiene literacy covers conditional access, MFA, privileged roles, app registrations, and guest access — identity hardening on YOUR $CLOUD_LAB tenant.
Visual · t31_entra_id_hygiene
Entra ID hygiene literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Azure identity is the control plane — literacy names Entra ID levers before attackers pivot through over-privileged apps in tenants you should protect.
Entra ID (Azure AD) hygiene includes MFA for admins and users, conditional access policies (location, device, risk), Privileged Identity Management just-in-time elevation, limiting app registration permissions, reviewing guest invitations, and disabling legacy auth. Cloud identity breaches often start with password spray or stolen refresh tokens — defender fix is CA and MFA, not stranger tenant enumeration. Cyberlium writes Entra ID hygiene checklist on YOUR $CLOUD_LAB personal tenant — paper design or sandbox toggles within free tier. Next: Sentinel Named.
1. Entra ID controls (named)
Conditional Access: require MFA, block legacy auth, require compliant device for admin roles. PIM: time-bound Global Admin activation with approval. App registration: restrict who can create apps; audit API permissions. Guest users: review external collaboration scope.
On $CLOUD_LAB, write five-item Entra ID hygiene checklist for fictional lab tenant.
Command guide
Try these commands — Entra ID controls (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Entra ID security — https://learn.microsoft.com/en-us/entra/fundamentals/security-operations-introduction Conditional Access — https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview Azure RBAC — https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/azure/entra-id-hygiene-checklist.md" <<'EOF'
# Entra ID Hygiene — YOUR subscription/tenant
- [ ] Conditional Access: MFA for admins and all users
- [ ] Block legacy authentication
- [ ] Privileged Identity Management for admin roles
- [ ] Guest user access reviews
- [ ] Service principal credential rotation
- [ ] No standing Global Administrator for daily work
Review in YOUR tenant only
EOFCommand — copy this
grep '\[ \]' "$CLOUD_LAB/azure/entra-id-hygiene-checklist.md" curl -sS https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Entra ID security (https://learn.microsoft.com/en-us/entra/fundamentals/security-operations-introduction); Conditional Access (https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview); Azure RBAC (https://learn.microsoft.com/en-us/azure/role-based-access-control/overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why identity hygiene parallels AWS IAM literacy
Both clouds: over-privileged principal + weak auth = breach. Entra CA is policy engine; AWS IAM plus IdP federation plays similar role. Multi-cloud analysts translate identity controls across vendors.
Students never test password spray against stranger Entra tenants — lab checklists only.
3. Literacy ≠ stranger tenant identity attacks
Forbidden: user enumeration or password spray on live portals you do not own. Allowed: Entra ID hygiene card — five controls with pass/fail on $CLOUD_LAB.
Ship: Entra ID hygiene checklist for YOUR lab tenant. Next: Sentinel Named.
4. What you ship: Entra ID hygiene checklist for $CLOUD_LAB
Five identity controls with pass/fail on lab tenant. $CLOUD_LAB named. NO stranger attacks. chmod 600.
5. What you record before the next lesson
Date. Entra ID checklist. $CLOUD_LAB named. File t31-m05-l02-entra-id-hygiene.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run password spray on stranger Microsoft login. Grant Global Admin to lab app 'for speed.'
Right
Write Entra ID hygiene checklist for YOUR $CLOUD_LAB tenant. Next: Sentinel Named.
Mission: harden Entra ID on YOUR lab tenant (paper check)
1) List MFA and CA targets for fictional admins. 2) Note PIM vs standing admin preference. 3) One app registration permission review item. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Block legacy auth before debating advanced CA — low-hanging identity fruit.
Knowledge Check
APPLY: Conditional Access primarily enforces:
Multiple choice
Knowledge Check
APPLY: True or False: MFA on privileged Entra roles is a baseline hygiene control.
True or False
Knowledge Check
APPLY: Entra ID hygiene literacy on Cyberlium avoids:
Multiple choice