>_cloudknowledge
Hands-on IAM labs on real tenants
The best place to learn
and practice Entra ID
24 identity skills and 181 hands-on labs. Run real Entra ID, Active Directory and Conditional Access configs, verify every step, then watch the walkthrough on YouTube.
learner@ck-lab-7f2c: ~ live tenant
PS>
A lab, recorded — Conditional Access, task 2 of 6
$ what is an identity? users, groups, devices, workloads$ authentication vs authorization$ install your first domain controller$ forests, domains and trusts$ kerberos flow: as, tgs, ap$ spns and delegation (constrained / rbcd)$ pki & cryptography foundations: root ca vs intermediate ca, x.509 v3, crl & ocsp$ deploy a two-tier enterprise active directory certificate services (ad cs) hierarchy$ create a tenant and custom domain$ users, guests and b2b collaboration$ entra connect sync vs cloud sync$ password hash sync$ how conditional access evaluates$ authentication methods policy$ eligible vs active assignments$ pim for entra roles$ access packages and catalogs$ connected organizations$ graph explorer and permissions$ connect-mggraph and scopes$ create a free okta org and tour the admin console$ users, groups and group rules$ saml app from the oin$ custom saml and oidc app integrations$ authenticators and enrollment policies$ global session policy$ okta workflows core architecture: flow designer, cards, connectors & execution engine$ build an event-driven user onboarding flow with slack notification & group assignment$ modern app authentication: oidc authorization code flow with pkce vs client credentials$ integrate okta hosted sign-in widget into a single-page app (react / next.js)$ oauth roles and grants$ authorization code + pkce$ saml flow: idp vs sp initiated$ assertions, claims and nameid$ scim 2.0 protocol deep dive: core schemas, /users, /groups & json http methods$ configure automated scim user provisioning from microsoft entra id to a saas app$ management groups, subscriptions, scopes$ built-in vs custom roles$ users, groups, roles and policies$ policy evaluation logic$ google cloud resource hierarchy: organizations, folders, projects & iam policy inheritance$ implement least-privilege iam with predefined & custom iam roles via gcloud cli$ zero trust principles$ identity as the control plane$ user and sign-in risk$ risk-based conditional access$ fido2 & webauthn mechanics: asymmetric key pairs, authenticator attestation & ctap2$ configure microsoft entra id fido2 security key authentication method policy
Guided paths
Pick a path. Every step is a lab.
IAM Engineer (Microsoft Entra)
From zero to running identity for a real company on Active Directory + Entra ID: SSO, MFA and automation.
Entra IDADSSOMFA
- 01IAM Fundamentals
- 02Active Directory Domain Services
- 03Microsoft Entra ID Fundamentals
- 04Hybrid Identity (Connect & Cloud Sync)
- +4 more skills
8 skills · 73 labs · ~94hStart roadmap →
Okta Engineer
Run Okta Workforce Identity end to end: directories, SSO, provisioning, adaptive MFA and Workflows.
OktaSSOSCIMMFA
- 01IAM Fundamentals
- 02Okta Workforce Identity Fundamentals
- 03SAML 2.0 & Enterprise SSO
- 04OAuth 2.0 & OpenID Connect
- +4 more skills
8 skills · 57 labs · ~80hStart roadmap →
Microsoft Identity Architect
Design identity at enterprise scale — hybrid, governance, privileged access and Zero Trust.
ArchitectureGovernanceZero Trust
- 01Microsoft Entra ID Fundamentals
- 02Hybrid Identity (Connect & Cloud Sync)
- 03Kerberos, NTLM & LDAP
- 04Conditional Access & MFA
- +4 more skills
8 skills · 65 labs · ~90hStart roadmap →
Skills
…or take one skill at a time.
IAMADKRBPKIEIDHYBCAPIMIGAPSOKTALCMOIEWFDEVOIDCSAMLSCIMRBACAWSGCPZTITDRFIDO
IAM Fundamentals
10 labs · ~8h
Active Directory Domain Services
12 labs · ~16h
Kerberos, NTLM & LDAP
7 labs · ~10h
PKI & Certificate Services
7 labs · ~12h
Microsoft Entra ID Fundamentals
10 labs · ~12h
Hybrid Identity (Connect & Cloud Sync)
10 labs · ~14h
Conditional Access & MFA
10 labs · ~12h
Privileged Identity Management
7 labs · ~8h
Entra ID Governance
8 labs · ~12h
Graph & PowerShell for Identity
8 labs · ~14h
Okta Workforce Identity Fundamentals
8 labs · ~10h
Okta SSO & Lifecycle Management
7 labs · ~12h
Okta Identity Engine Policies & Adaptive MFA
7 labs · ~10h
Okta Workflows Automation
6 labs · ~10h
Okta for Developers (OIDC & APIs)
6 labs · ~12h
OAuth 2.0 & OpenID Connect
7 labs · ~10h
SAML 2.0 & Enterprise SSO
6 labs · ~8h
SCIM & App Provisioning
6 labs · ~8h
Azure RBAC & Managed Identities
7 labs · ~10h
AWS IAM & IAM Identity Center
7 labs · ~12h
Google Cloud IAM
6 labs · ~10h
Zero Trust Identity Architecture
6 labs · ~10h
Identity Threat Detection & Response
7 labs · ~12h
Passwordless & Passkeys
6 labs · ~8h
Certifications
Know what the exam tests before you sit it.
Domain weights, exam format, a week-by-week prep roadmap and the exact labs that cover each objective.
See certification roadmaps →01
Read the brief
Every lab starts with a real scenario — a tenant, a ticket, a risk to fix.
02
Do it hands-on
Use the portal, PowerShell or Graph exactly like you would at work.
03
Verify, then watch
A checklist confirms your config is right. The YouTube walkthrough explains the why.