>_cloudknowledge
Hands-on IAM labs on real tenants
The best place to learn
and practice Entra ID
24 identity skills and 175 hands-on labs. Run real Entra ID, Active Directory and Conditional Access configs, verify every step, then watch the walkthrough on YouTube.
learner@ck-lab-7f2c: ~ live tenant
PS>
A lab, recorded — Conditional Access, task 2 of 6
$ what is an identity? users, groups, devices, workloads$ authentication vs authorization$ install your first domain controller$ forests, domains and trusts$ kerberos flow: as, tgs, ap$ spns and delegation (constrained / rbcd)$ pki basics: ca, chain, crl, ocsp$ deploy a two-tier ad cs$ create a tenant and custom domain$ users, guests and b2b collaboration$ entra connect sync vs cloud sync$ password hash sync$ how conditional access evaluates$ authentication methods policy$ eligible vs active assignments$ pim for entra roles$ access packages and catalogs$ connected organizations$ graph explorer and permissions$ connect-mggraph and scopes$ create a free okta org and tour the admin console$ users, groups and group rules$ saml app from the oin$ custom saml and oidc app integrations$ authenticators and enrollment policies$ global session policy$ flows, cards and connectors$ event hooks and scheduled flows$ add okta sign-in to a web app$ custom authorization servers and scopes$ oauth roles and grants$ authorization code + pkce$ saml flow: idp vs sp initiated$ assertions, claims and nameid$ scim 2.0 basics$ provisioning in entra id$ management groups, subscriptions, scopes$ built-in vs custom roles$ users, groups, roles and policies$ policy evaluation logic$ resource hierarchy and policies$ predefined vs custom roles$ zero trust principles$ identity as the control plane$ user and sign-in risk$ risk-based conditional access$ why passwords fail$ passkeys and fido2$ what is an identity? users, groups, devices, workloads$ authentication vs authorization$ install your first domain controller$ forests, domains and trusts$ kerberos flow: as, tgs, ap$ spns and delegation (constrained / rbcd)$ pki basics: ca, chain, crl, ocsp$ deploy a two-tier ad cs$ create a tenant and custom domain$ users, guests and b2b collaboration$ entra connect sync vs cloud sync$ password hash sync$ how conditional access evaluates$ authentication methods policy$ eligible vs active assignments$ pim for entra roles$ access packages and catalogs$ connected organizations$ graph explorer and permissions$ connect-mggraph and scopes$ create a free okta org and tour the admin console$ users, groups and group rules$ saml app from the oin$ custom saml and oidc app integrations$ authenticators and enrollment policies$ global session policy$ flows, cards and connectors$ event hooks and scheduled flows$ add okta sign-in to a web app$ custom authorization servers and scopes$ oauth roles and grants$ authorization code + pkce$ saml flow: idp vs sp initiated$ assertions, claims and nameid$ scim 2.0 basics$ provisioning in entra id$ management groups, subscriptions, scopes$ built-in vs custom roles$ users, groups, roles and policies$ policy evaluation logic$ resource hierarchy and policies$ predefined vs custom roles$ zero trust principles$ identity as the control plane$ user and sign-in risk$ risk-based conditional access$ why passwords fail$ passkeys and fido2
Guided paths
Pick a path. Every step is a lab.
IAM Engineer (Microsoft Entra)
From zero to running identity for a real company on Active Directory + Entra ID: SSO, MFA and automation.
Entra IDADSSOMFA
- 01IAM Fundamentals
- 02Active Directory Domain Services
- 03Microsoft Entra ID Fundamentals
- 04Hybrid Identity (Connect & Cloud Sync)
- +4 more skills
8 skills · 73 labs · ~94hStart roadmap →
Okta Engineer
Run Okta Workforce Identity end to end: directories, SSO, provisioning, adaptive MFA and Workflows.
OktaSSOSCIMMFA
- 01IAM Fundamentals
- 02Okta Workforce Identity Fundamentals
- 03SAML 2.0 & Enterprise SSO
- 04OAuth 2.0 & OpenID Connect
- +4 more skills
8 skills · 55 labs · ~76hStart roadmap →
Microsoft Identity Architect
Design identity at enterprise scale — hybrid, governance, privileged access and Zero Trust.
ArchitectureGovernanceZero Trust
- 01Microsoft Entra ID Fundamentals
- 02Hybrid Identity (Connect & Cloud Sync)
- 03Kerberos, NTLM & LDAP
- 04Conditional Access & MFA
- +4 more skills
8 skills · 65 labs · ~90hStart roadmap →
Skills
…or take one skill at a time.
IAMADKRBPKIEIDHYBCAPIMIGAPSOKTALCMOIEWFDEVOIDCSAMLSCIMRBACAWSGCPZTITDRFIDO
IAM Fundamentals
10 labs · ~8h
Active Directory Domain Services
12 labs · ~16h
Kerberos, NTLM & LDAP
7 labs · ~10h
PKI & Certificate Services
coming soon
Microsoft Entra ID Fundamentals
10 labs · ~12h
Hybrid Identity (Connect & Cloud Sync)
10 labs · ~14h
Conditional Access & MFA
10 labs · ~12h
Privileged Identity Management
7 labs · ~8h
Entra ID Governance
8 labs · ~12h
Graph & PowerShell for Identity
8 labs · ~14h
Okta Workforce Identity Fundamentals
8 labs · ~10h
Okta SSO & Lifecycle Management
7 labs · ~12h
Okta Identity Engine Policies & Adaptive MFA
7 labs · ~10h
Okta Workflows Automation
coming soon
Okta for Developers (OIDC & APIs)
coming soon
OAuth 2.0 & OpenID Connect
7 labs · ~10h
SAML 2.0 & Enterprise SSO
6 labs · ~8h
SCIM & App Provisioning
coming soon
Azure RBAC & Managed Identities
7 labs · ~10h
AWS IAM & IAM Identity Center
7 labs · ~12h
Google Cloud IAM
coming soon
Zero Trust Identity Architecture
6 labs · ~10h
Identity Threat Detection & Response
7 labs · ~12h
Passwordless & Passkeys
coming soon
Certifications
Know what the exam tests before you sit it.
Domain weights, exam format, a week-by-week prep roadmap and the exact labs that cover each objective.
See certification roadmaps →01
Read the brief
Every lab starts with a real scenario — a tenant, a ticket, a risk to fix.
02
Do it hands-on
Use the portal, PowerShell or Graph exactly like you would at work.
03
Verify, then watch
A checklist confirms your config is right. The YouTube walkthrough explains the why.