Secure Azure Identity Control Plane

Set up group-scoped Azure RBAC and test MFA for Azure management.

Introduction

30 Second Summary

A networking lab can be carefully designed. One overpowered account can still reach far beyond it.

In this project, you will secure the identity control plane for a future Azure networking lab. You will combine group-based network access with a safely tested MFA policy.

What You'll Build

You select the lab operator and see Network Contributor access limited to rg-hybridlab-identity. You then run What If to confirm that MFA applies without enforcing the policy.

By the end of this project, you'll have:

A cloud-only lab operator whose access changes through membership in an assigned security group.
A before-and-after Azure RBAC check that first shows the operator without group-based network access. The second check shows Network Contributor inherited through the lab group.
A report-only Conditional Access evaluation that shows the MFA policy applying to the intended operator during a What If test.
Secret Mission: Generate a real Azure sign-in event. Capture the report-only Conditional Access result from the sign-in log.

Are there any prerequisites?

You need a Windows device with an Azure subscription. You also need one available license that includes Microsoft Entra ID P1.

Your account needs permission to manage the project identities, licenses, Conditional Access policies, resource group, and Azure role assignments.

Before We Start

Before any hands-on work begins, commit to protecting the cloud-only lab operator. Its Azure permissions will stop at the dedicated lab resource group instead of extending across the subscription.

Prepare a Safe Identity Sandbox

Identity changes in a Microsoft Entra ID tenant can affect every user in that tenant. An Azure RBAC assignment at the wrong scope can spread access beyond this lab.

This step confirms your administrative reach before any identity or Conditional Access policy is created. You will create one empty resource group as the boundary for later role assignments.

In this step, get ready to:

Confirm the intended tenant and subscription.
Confirm the available license capacity and required permissions.
Create the empty lab resource group.

Confirm the tenant, subscription, and license

Your Microsoft Entra tenant contains the identities for this lab. Your Azure subscription supplies the resource scope that those identities will manage.

Open the Microsoft Entra admin center in your browser.
Sign in with the administrator account you plan to use for this project.
Read the tenant name displayed in the admin center.
Confirm that the displayed name matches your intended tenant.
Open Azure portal in a new browser tab.
Sign in with the same administrator account.
Select the intended subscription using the portal's subscription selector.
Confirm that Azure portal shows the same tenant as the Microsoft Entra admin center.

The Microsoft Entra admin center should show the intended tenant. Azure portal should show that same tenant with the intended subscription selected.

Open the Microsoft 365 Admin Center in another browser tab.
Sign in with your administrator account.
Select Billing in the navigation menu.
Select Licenses.
Select the product license that includes Microsoft Entra ID P1.
Check that the product has at least one assignable seat available.

You should see enough unused capacity to license one test operator later in the project.

Why confirm a spare license?

Using Conditional Access requires Microsoft Entra ID P1. The spare seat lets the test operator participate in the policy pilot.

No assignable license available?

Stop before creating the test operator in the next step.
Ask a License Administrator or User Administrator to make one compatible seat available.

Help me check why my Microsoft Entra ID P1-capable product has no assignable seats.

That entitlement check is complete. You now know the test operator can receive a compatible license without affecting your primary administrator account.

Verify every required permission

Microsoft Entra roles govern directory controls. Azure permissions govern resource controls. Checking both keeps this setup aligned with least privilege.

Which permissions are required?

User management requires User Administrator.
Group management requires User Administrator or Groups Administrator.
License assignment requires License Administrator or User Administrator.
Conditional Access policy management requires Conditional Access Administrator.
Azure role assignment requires Microsoft.Authorization/roleAssignments/write, such as through Role Based Access Control Administrator or User Access Administrator.

Switch back to the Microsoft Entra admin center tab.
Select Entra ID.
Select Roles and administrators.
Select Your Role.
Confirm that your role list covers user management.
Confirm that your role list covers group management.
Confirm that your role list covers license assignment.
Confirm that your role list covers Conditional Access policy management.

Your role list should cover every Microsoft Entra capability shown in the permission guide above.

Switch back to the Azure portal tab.
Open the intended subscription.
Select Access control (IAM).
Select the Check access tab.
Select Check access.
Choose User, group, or service principal.
Select your signed-in administrator identity.

You should see an assignment that grants Azure role-assignment permission at the subscription scope. The assignment may appear as Role Based Access Control Administrator or User Access Administrator.

Missing a required permission?

Ask your tenant administrator to confirm any missing Microsoft Entra role before you continue.
Ask your Azure administrator to provide an approved assignment containing Microsoft.Authorization/roleAssignments/write at the required scope.

Help me identify which permission is missing from my Azure identity sandbox setup.

Create the resource group and verify access

For this lab, a dedicated resource group is the smallest useful scope for the future networking resources. No workload resources are deployed during this step.

Switch back to the Azure portal tab.
Select Resource groups.
Select Create.
Choose your intended subscription in the Subscription field.
Enter rg-hybridlab-identity in the Resource group field.
Choose your preferred Azure region in the Region field.
Select Review + Create.
Select Create after validation passes.

That is the lab boundary in place. The rg-hybridlab-identity resource group now exists as an empty management boundary.

Can't create the resource group?

Confirm that the intended subscription remains selected.
Ask your Azure administrator to verify that your account can create resource groups in that subscription.

Help me diagnose why Azure portal will not create my resource group.

Before you verify the controls, do you expect an empty resource group to expose role-assignment controls?

Return to Resource groups in Azure portal.
Select rg-hybridlab-identity.
Confirm that the Overview page opens.
Select Access control (IAM).
Confirm that Add role assignment is available.

The Azure scope check is complete. Finish by testing the policy-management surface.

Switch back to the Microsoft Entra admin center tab.
Select Entra ID.
Select Conditional Access.
Select Policies.
Confirm that the policies list loads.

The resource group should open to Overview. Its Access control (IAM) page should show Add role assignment as available.

The Conditional Access Policies list should load. You have now proved that both control planes are available.

Missing a required control?

Ask your Azure administrator to review your role-assignment permission if Add role assignment is unavailable.
Confirm your Microsoft Entra ID P1 entitlement if the Conditional Access page does not load.
Ask your tenant administrator to confirm your Conditional Access Administrator role if policy management remains unavailable.

Help me troubleshoot the missing control in my identity sandbox verification.

Your safe identity boundary is ready. Next, you'll create the cloud-only lab operator and prove that it begins without resource access.

Prove the Operator Starts Without Resource Access

Your isolated resource group is ready. Next, you will create a lab operator inside the intended tenant.

Microsoft Entra ID controls who the operator is. Azure RBAC controls what that identity can manage at an Azure scope.

This step tests whether a valid cloud identity automatically receives resource permissions. The final access check turns that boundary into visible evidence.

In this step, get ready to:

Prepare a licensed cloud-only lab operator.
Create an assigned security group for the operator.
Capture the operator's access result at the lab resource-group scope.

Create and license the lab operator

A cloud-only identity lives directly in your tenant. You will create the operator as an internal member with an automatically generated initial password.

The later Conditional Access pilot requires Microsoft Entra ID P1. The operator therefore needs the available qualifying product license you confirmed in Step 1.

Credentials can feel high-stakes. The initial password only needs a safe home in your password manager.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Users.
Select New user.
Select Create new user.

What makes this an internal member?

The User type setting identifies whether the account belongs to your organization or represents a guest. Selecting Member keeps this lab operator inside your tenant.

Enter lab-operator in the User principal name field.
Enter lab-operator in the Display name field.
Select Auto-generate password in the Password section.
Leave Account enabled selected.
Select Member for User type.
Submit the form to create the user.
Copy the full user principal name into a secure password-manager entry.
Copy the auto-generated initial password into the same password-manager entry when the portal displays it.

The new user now appears in your tenant as an enabled internal member. Keep every screenshot in this step away from the initial password.

Open a new browser tab.
Search for the Microsoft 365 admin center.
Open the official Microsoft result.
Sign in with the administrator account from earlier if prompted.

Product licenses are assigned through the Microsoft 365 admin center. You will use the available P1-capable product identified in Step 1.

Select Billing.
Select Licenses.
Select the available product that includes Microsoft Entra ID P1.
Select Assign licenses.
Search for lab-operator in the user picker.
Select lab-operator.
Select Assign.

You will see confirmation that the product license was assigned to lab-operator. The operator is now licensed for the later P1-backed policy test.

Unable to assign the license?

Confirm that lab-operator appears in the tenant's user list.
Confirm that the selected product still has an available license.
Confirm that you are using the administrator account checked in Step 1.

Help me resolve a user or license assignment problem.

Build the operator security group

An assigned security group gives you one place to manage the lab operator set. Explicit membership also makes it clear which identity belongs in the pilot.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID.
Select Groups.
Select All groups.
Select New group.

The new-group form brings membership controls together with the directory-role setting. Each value defines a different part of the group's purpose.

Select Security as the Group type.
Enter sg-hybridlab-network-operators as the group name.
Leave Microsoft Entra roles can be assigned to the group set to No.
Select Assigned as the Membership type.
Open the group form's member selector.
Search for lab-operator.
Select lab-operator as the member.
Submit the form to create the group.

Open sg-hybridlab-network-operators from All groups.

The group overview shows a Security group with Assigned membership. Its directory-role switch remains set to No.

Select Members.

You will see lab-operator in the membership list. The operator can now be managed through this assigned group.

Why keep the directory-role switch off?

The Microsoft Entra roles can be assigned to the group switch applies to directory roles that manage Microsoft Entra resources. This project uses the group for an Azure resource role instead.

Keeping the switch at No preserves the boundary between directory administration and Azure resource authorization.

Group or member missing?

Return to All groups.
Search for sg-hybridlab-network-operators.
Open the group.
Check that lab-operator appears under Members.

Help me fix the lab security group.

Check the operator's resource access

The Check access view resolves role assignments at the current scope. It also includes assignments inherited from broader Azure scopes.

You will now test the operator exactly as it exists after user and group creation. This is the evidence point for the identity boundary.

Switch back to the Azure portal from earlier.
Return to rg-hybridlab-identity.
Select Access control (IAM).
Select the Check access tab.
Select Check access.
Choose User, group, or service principal.

Before you select the operator, predict whether creating the identity and group has granted a network-management role at this resource-group scope.

Search for lab-operator.
Select lab-operator to run the access check.

You will see no Network Contributor assignment for lab-operator at rg-hybridlab-identity. The assignments pane does not list that role through sg-hybridlab-network-operators.

Why is the assignment missing?

Default deny means an identity receives no Azure resource permission until a role assignment grants it. Creating a user or adding that user to a group does not create an Azure role assignment.

This result proves that directory membership and resource authorization are separate controls. You now have before-state evidence for the access change in the next step.

Seeing an unexpected assignment?

Confirm that the current scope is rg-hybridlab-identity.
Confirm that the selected identity is lab-operator.
Stop before continuing if Network Contributor already appears.

Help me investigate this unexpected role assignment.

Strong work. Your access check now proves that the operator starts without a Network Contributor assignment.

Next, you will grant that role through the security group at the resource-group scope.

Grant Network Access Through the Group

Your baseline check proved that lab-operator has no Network Contributor access to the lab resource group. That clean default-deny result gives you evidence to compare against.

You will now use Azure RBAC to grant the role through the security group at the rg-hybridlab-identity scope. This least-privilege design closes the access gap while keeping the subscription outside the assignment.

In this step, get ready to:

Start an Azure role assignment from the lab resource group.
Assign Network Contributor to the operator security group.
Verify that the operator receives access through group membership.

Start the role assignment at the resource group

An Azure role assignment takes its scope from the resource where you start it. Beginning inside rg-hybridlab-identity keeps the permission boundary around this lab.

Switch back to the Azure portal session from earlier.
Select Resource groups from the portal menu.
Select rg-hybridlab-identity from the resource-group list.
Select Access control (IAM) from the resource menu.
Select the Role assignments tab.
Select Add from the toolbar.
Select Add role assignment.

You will see the role-assignment pane for the current resource-group scope. The role choice comes next.

Is the assignment control unavailable?

A disabled Add role assignment control means your account lacks Microsoft.Authorization/roleAssignments/write at this scope.

Return to the permission check from Step 1 before continuing. Help me diagnose a disabled Azure role assignment control.

Assign the network role to the group

Network Contributor covers network management within the selected scope. Virtual machine management stays outside this role.

Why use the group at this scope?

Assigning Azure RBAC permissions to a group makes membership the control point for future operators. The role assignment stays in place as group membership changes.

The resource-group scope confines network management to rg-hybridlab-identity. The subscription stays outside this assignment.

The group's Microsoft Entra roles can be assigned to the group setting stays No. This flow assigns an Azure resource role.

Enter Network Contributor in the Search box on the Role tab.
Select Network Contributor from the results.
Select Next.
Select User, group, or service principal on the Members tab.
Select Select members.
Enter sg-hybridlab-network-operators in the Select box.
Select sg-hybridlab-network-operators from the results.
Select Select to add the group to the members list.

The members list now names sg-hybridlab-network-operators as the principal that receives the role.

Select Next to continue to the review stage.

The assignment summary should show Network Contributor for sg-hybridlab-network-operators. Its scope should be rg-hybridlab-identity.

This permission change stays inside the lab resource group. Your wider subscription remains outside its reach.

Select Review + assign to create the role assignment.

The assignment can take a few moments to appear. A short wait here is normal.

Use the Search box on the Role assignments tab to locate sg-hybridlab-network-operators.

You should see the group paired with Network Contributor on the rg-hybridlab-identity page. You have closed the access gap at the intended boundary.

Cannot find the group assignment?

Confirm that the selected principal is sg-hybridlab-network-operators.
Refresh the Role assignments tab after a short wait.
Check that you are viewing Access control (IAM) for rg-hybridlab-identity.

Help me find my missing Azure role assignment.

Verify the operator inherits the role

The role belongs to the group. A fresh access check now proves that lab-operator receives it through membership.

Select the Check access tab in Access control (IAM).

Before you run the check, do you expect the operator's result to match the no-assignment evidence from earlier?

Select Check access.
Select User, group, or service principal.
Enter lab-operator in the identity search field.
Select lab-operator from the results.

The assignments pane now lists Network Contributor at rg-hybridlab-identity through sg-hybridlab-network-operators.

Compare the new result with the pre-assignment evidence you captured in Step 2.

You now have a visible before-and-after proof. The operator moved from default deny to group-based network access at one resource-group scope.

Still seeing no network access?

Confirm that the role-assignment principal is sg-hybridlab-network-operators.
Confirm that the assignment scope is rg-hybridlab-identity.
Refresh the access check after the assignment appears on the Role assignments tab.

Help me troubleshoot missing inherited access for the lab operator.

Your operator now receives job-specific network access through group membership at the smallest useful scope. Next, you will add stronger sign-in verification for Azure management in a safe test mode.

Pilot MFA for Azure Management

Your security group now gives lab-operator the Network Contributor role only at rg-hybridlab-identity. Azure RBAC controls the resources that operator can manage.

That resource permission does not add stronger sign-in verification. Microsoft Entra Conditional Access will evaluate a multifactor authentication requirement for Azure management in Report-only mode.

In this step, get ready to:

Create a report-only policy scoped only to sg-hybridlab-network-operators.
Add an MFA grant control for Azure management access.
Run a Conditional Access What If evaluation for lab-operator.

Create the pilot policy

A Conditional Access user assignment decides which identities enter the policy evaluation. Targeting the existing group keeps membership as the control point.

Switch back to the Microsoft Entra admin center from earlier.
Select Entra ID in the left navigation.
Select Conditional Access.
Select Policies.
Select New policy.
Enter CA-Lab-AzureManagement-MFA-ReportOnly in Name.

The new policy editor now holds the policy name. Next, you will limit its identity scope to the lab group.

Select Users or workload identities under Assignments.
Under Include, select Users and groups.
Search for sg-hybridlab-network-operators.
Select sg-hybridlab-network-operators.
Select Select to confirm the inclusion.

The inclusion summary should show only sg-hybridlab-network-operators. Your administrator identity remains outside this pilot scope.

Why target the group?

Group targeting keeps policy scope tied to the same membership model as the Azure role assignment. Adding or removing a lab operator changes that person's policy evaluation.

The group is now the control point for both resource authorization and MFA evaluation.

Add the Azure management MFA control

The target resource decides where the policy applies. The grant control decides which sign-in requirement is evaluated.

Select Target resources.
Select Resources (formerly cloud apps) as the policy target type.
Under Include, select Select resources.
Search for Windows Azure Service Management API.
Select Windows Azure Service Management API.
Select Select to confirm the resource.

The target-resource summary should now show Windows Azure Service Management API.

Why this resource?

Windows Azure Service Management API represents Azure management access used by the Azure portal. This keeps the policy focused on management activity.

Select Grant under Access controls.
Select Grant access.
Select Require multifactor authentication.
Select Select to confirm the grant control.

Why use Report-only?

Report-only evaluates the policy during sign-in. The MFA grant control remains unenforced.

The policy does not prompt or block lab-operator. You can inspect its impact safely.

Set Enable policy to Report-only.
Review the included identity summary.
Confirm that only sg-hybridlab-network-operators is included.
Select Create.

You should see CA-Lab-AzureManagement-MFA-ReportOnly in the policies list with a Report-only state. You have safely staged the MFA policy without enforcing it.

Policy missing from the list?

Confirm that the intended tenant remains selected in the Microsoft Entra admin center.
Confirm that your administrator account has the Conditional Access Administrator role.
Return to the policy editor to check each required assignment.
Help me diagnose why my Conditional Access policy was not created.

Test the policy with What If

Saving the policy confirms that its configuration exists. What If simulates a sign-in to show whether that configuration applies under specific conditions.

In the Policies page, select What If.
Select lab-operator for the identity condition.
Select Windows Azure Service Management API for the target resource condition.
Select Windows for the device platform condition.
Select Browser for the client app condition.

Before you run the evaluation, do you expect the new policy to apply to this identity and resource?

Run the evaluation by selecting What If.

You should see CA-Lab-AzureManagement-MFA-ReportOnly under the policies that apply. Its grant controls should show Require multifactor authentication.

What does this result prove?

The result connects the group membership of lab-operator to the Azure management policy scope. It also confirms that the MFA grant control is part of the evaluation.

Report-only keeps that result as evidence of expected policy behavior without enforcing the control.

Policy not applying?

Confirm that lab-operator still belongs to sg-hybridlab-network-operators.
Confirm that the policy state remains Report-only.
Confirm that the target resource is Windows Azure Service Management API.
Help me find why my Conditional Access policy does not apply.

Your identity control plane now combines group-scoped Azure authorization with safely tested MFA protection.

Secret mission

Prove the Policy Evaluates During a Real Sign-In

What If predicts policy behavior from selected conditions. This challenge turns that prediction into runtime evidence from a real lab-operator sign-in. You will capture the report-only result from the matching event.

Clean Up Your Resources

Keeping this identity lab adds no metered Azure workload charges. The assigned product license still occupies one existing Microsoft Entra ID P1-capable seat.

Resources you used:

Azure resource group rg-hybridlab-identity with no deployed workloads.
Cloud-only user lab-operator with one existing Microsoft Entra ID P1-capable product license assigned.
Assigned Security group sg-hybridlab-network-operators with lab-operator as a member.
Azure RBAC assignment granting Network Contributor to sg-hybridlab-network-operators at the rg-hybridlab-identity scope.
Conditional Access policy CA-Lab-AzureManagement-MFA-ReportOnly requiring MFA for Azure management in Report-only mode.

Keep everything running

No action is needed. This option keeps the identity foundation ready for a future Azure networking lab.

Leave CA-Lab-AzureManagement-MFA-ReportOnly in Report-only mode.
Keep the Microsoft Entra ID P1-capable product license assigned to lab-operator.
Keep sign-in enabled for lab-operator.
Retain the operator's membership in sg-hybridlab-network-operators.
Retain the Network Contributor assignment at the rg-hybridlab-identity scope.
Keep rg-hybridlab-identity for the next networking project.

Pause - I'll come back to this later

Pausing stops the test identity from signing in. It preserves the group-based access design for your return.

Return to the Conditional Access Policies page in the Microsoft Entra admin center.
Select CA-Lab-AzureManagement-MFA-ReportOnly.
Set Enable policy to Off.
Apply the policy change.

The policy is now inactive. The occupied license seat can return to your available pool.

Return to the Microsoft 365 admin center from earlier.
Select Billing in the left menu.
Select Licenses.
Select the product that includes Microsoft Entra ID P1.
Remove the product license assignment from lab-operator.

The final pause control prevents the test user from creating new sign-in events.

Return to the lab-operator profile in the Microsoft Entra admin center.
Disable sign-in for lab-operator in the user's profile settings.
Leave sg-hybridlab-network-operators in place.
Leave the Network Contributor assignment in place.
Keep rg-hybridlab-identity in place.

Delete - I don't want to use this again

Remove the complete identity lab when you no longer need its user, group, access assignment, policy, or resource group.

Delete in dependency order

Removing the identity lab can feel like a big reset. The order below switches off the policy before removing the objects it depends on.

Start with the custom policy so it stops evaluating the group.

Return to the Conditional Access Policies page from earlier.
Select CA-Lab-AzureManagement-MFA-ReportOnly.
Set Enable policy to Off.
Apply the policy change.
Delete CA-Lab-AzureManagement-MFA-ReportOnly.
Confirm the policy deletion.

The group is no longer targeted by the custom policy. Remove its Azure resource permission next.

Switch back to the Azure portal from earlier.
Return to rg-hybridlab-identity.
Select Access control (IAM).
Select Role assignments.
Select the Network Contributor assignment for sg-hybridlab-network-operators.
Choose Remove.
Choose Yes.
Confirm that the assignment no longer appears in Role assignments.

The security group no longer carries Azure resource access. You can now remove the directory objects.

Return to the Microsoft Entra admin center.
Return to Entra ID from earlier.
Select Groups.
Select All groups.
Select sg-hybridlab-network-operators.
Choose Delete.

The group is gone. Deleting the test user also releases its assigned product license for reuse.

Return to the Users page.
Select lab-operator.
Choose Delete user.

The identity resources are cleared. Finish by removing the empty Azure resource group.

Switch back to the Azure portal.
Return to rg-hybridlab-identity.
Select Delete resource group.
Complete the portal confirmation prompt.
Return to the Resource groups list.
Confirm that rg-hybridlab-identity no longer appears.

That completes the teardown. No active lab identity configuration remains.

Nice Work!

Excellent work! You built a least-privilege identity control plane for your future Azure network lab.

What you learned:

Created a cloud-only operator in Microsoft Entra whose access is managed through sg-hybridlab-network-operators. Your before-and-after Check access evidence proves that the operator began without a group-based Network Contributor assignment.
Applied Azure RBAC at the smallest useful scope. The Network Contributor assignment stops at rg-hybridlab-identity.
Built CA-Lab-AzureManagement-MFA-ReportOnly as a Conditional Access policy in Report-only mode. The What If result confirms that the Require multifactor authentication grant control applies without enforcement.
Secret Mission: Connected a real Azure portal sign-in to CA-Lab-AzureManagement-MFA-ReportOnly in Microsoft Entra sign-in logs. Your captured Conditional Access tab proves that the report-only policy was evaluated at runtime.

Ready to quiz yourself?