01
Build a tenant from scratch: users, dynamic groups, administrative units and delegated roles
02
Install Entra Connect against a lab domain and prove the sync cycle end to end
03
Break and fix hybrid sync - duplicate UPNs, filtered OUs and stale objects
04
Roll out MFA with a registration campaign, then enforce it with conditional access
05
Configure passwordless sign-in with Windows Hello for Business and a FIDO2 key
06
Build a conditional access baseline in report-only mode, analyse the impact, then enforce
07
Publish a SAML application with claims mapping and test single sign-on
08
Expose an on-premises web app through Application Proxy
09
Invite a guest, scope them with cross-tenant access settings, then review and remove access
10
Create an access package with an approval workflow and run an access review on it
11
Configure PIM for the Global Administrator role, including approval and justification
12
Investigate a simulated risky sign-in through the logs and write the incident note