Skills
Each skill is a set of hands-on labs. Roadmaps pick skills in order — or jump straight into the one you need.
Identity Foundations (4)
IAM Fundamentals
Identities, authentication vs authorization, least privilege, RBAC vs ABAC and the identity lifecycle.
Active Directory Domain Services
Build a domain from scratch: forests, OUs, GPOs, DNS, sites, replication and FSMO roles.
Kerberos, NTLM & LDAP
How Windows authentication actually works on the wire, and how to troubleshoot it.
PKI & Certificate Services
Run AD CS, issue certificates and use them for smart-card and certificate-based auth.
Microsoft Entra (6)
Microsoft Entra ID Fundamentals
Tenants, users, groups, licenses, admin roles and app registrations in Microsoft Entra ID.
Hybrid Identity (Connect & Cloud Sync)
Sync on-prem AD to Entra ID with Connect Sync or Cloud Sync — PHS, PTA, federation and seamless SSO.
Conditional Access & MFA
Design a Zero Trust Conditional Access baseline — MFA, device compliance, locations and session controls.
Privileged Identity Management
Just-in-time admin access with approvals, MFA on activation and access reviews.
Entra ID Governance
Entitlement management, access packages, access reviews, lifecycle workflows and HR-driven provisioning.
Graph & PowerShell for Identity
Automate Entra ID with Microsoft Graph, the Graph PowerShell SDK and managed identities.
Okta (5)
Okta Workforce Identity Fundamentals
Your first Okta org: users, groups, directories, the AD agent and the Okta Integration Network.
Okta SSO & Lifecycle Management
Connect apps with SAML and OIDC, provision users automatically and map profiles.
Okta Identity Engine Policies & Adaptive MFA
Authenticators, global session and app sign-in policies, FastPass and ThreatInsight.
Okta Workflows Automation
No-code identity automation: flows, connectors, tables and scheduled jobs.
Okta for Developers (OIDC & APIs)
Secure apps and APIs with Okta: OIDC sign-in, authorization servers, scopes and the Okta API.
Protocols & SSO (3)
OAuth 2.0 & OpenID Connect
Tokens, flows and scopes — decode real JWTs and integrate an app with Entra ID.
SAML 2.0 & Enterprise SSO
Configure SAML SSO for SaaS apps, read assertions and fix the usual errors.
SCIM & App Provisioning
Automatic user provisioning to SaaS apps with SCIM and attribute mappings.
Cloud IAM (3)
Azure RBAC & Managed Identities
Scopes, built-in and custom roles, ABAC conditions, managed identities and workload identity federation.
AWS IAM & IAM Identity Center
Policies, roles, SCPs, permission boundaries and SSO into AWS from Entra ID.
Google Cloud IAM
Resource hierarchy, roles, service accounts and workforce identity federation.
Identity Security (3)
Zero Trust Identity Architecture
Design identity as the control plane: verify explicitly, least privilege, assume breach.
Identity Threat Detection & Response
Entra ID Protection, Defender for Identity and hunting identity attacks in KQL.
Passwordless & Passkeys
Roll out passkeys, FIDO2 keys, Windows Hello for Business and phishing-resistant MFA.