Zero Trust Identity Lab with Entra ID

Secure privileged access using Conditional Access, PIM, and MFA in Entra ID.

Introduction

30 Second Summary

You wouldn't give every employee the master key to your building and let them keep it forever. The same principle applies to cloud security. Admin access should be temporary, verified, and earned every single time.

In this project, you will build a Zero Trust identity security lab using Microsoft Entra ID. You'll create dedicated admin accounts, enforce multi-factor authentication through Conditional Access policies, and configure Privileged Identity Management so that admin access is never permanent.

What You'll Build

A fully configured Microsoft Entra ID tenant with Conditional Access policies enforcing MFA for privileged roles and Privileged Identity Management providing just-in-time, time-bound Global Administrator access.

By the end of this project, you'll have:

An organizational identity structure with dedicated admin accounts and security groups following least privilege principles.
Conditional Access policies that enforce MFA for all privileged administrator roles.
Privileged Identity Management configured for just-in-time Global Administrator access, with a tested end-to-end elevation workflow.
A risk-based Conditional Access policy using Identity Protection and the What If simulation tool (Secret Mission).

Are there any prerequisites?

You need an Azure account with Global Administrator access to a Microsoft Entra ID tenant. You also need the Microsoft Authenticator app installed on your mobile device. The Entra ID P2 trial activation is covered in Step 1.

Activate the Entra ID P2 Trial and Prepare the Tenant

Your Azure tenant comes with Microsoft Entra ID Free, which covers basic user management and single sign-on.

The advanced features you need for this project require Entra ID P2. In this step, you'll activate a free 30-day P2 trial and disable Security Defaults to clear the way for custom Conditional Access policies.

In this step, get ready to:

Activate the Entra ID P2 free trial on your tenant.
Disable Security Defaults to prepare for custom Conditional Access policies.
Assign the P2 license to your admin account.

Activate the Entra ID P2 free trial

Open your browser and navigate to https://entra.microsoft.com.
Sign in with your Global Administrator account.
In the left navigation, expand Identity.
Select Billing.
Select Licenses.
Click All products.
Click + Try/Buy.
Find Microsoft Entra ID P2 in the list.
Click Free trial.
Click Activate.
Confirm that Microsoft Entra ID P2 now appears under All products.

What does Entra ID P2 unlock?

The P2 tier adds the premium security features you'll use throughout this project.

Conditional Access for custom security policies that target specific users, roles, or conditions.
Privileged Identity Management (PIM) for just-in-time admin access that expires automatically.
Identity Protection for risk-based sign-in detection and automated responses.

The trial is free for 30 days with no charges during the trial period.

Can't find the Try/Buy option?

The exact navigation path may vary slightly depending on your tenant configuration. If you don't see Billing under Identity, try searching for "Licenses" in the Entra admin center search bar at the top of the page.

If your tenant already has P2 licenses (from a previous trial or subscription), you may not see the free trial option. Check All products to see if P2 is already listed.

Help me find the Entra ID P2 trial activation in my tenant

Disable Security Defaults

Security Defaults provide a baseline MFA layer that applies to every user in your tenant. They conflict with Conditional Access policies, so you need to disable them before creating custom policies.

In the left navigation, expand Identity and select Overview.
Click Properties.
Scroll to the bottom of the page and click Manage security defaults.
Set Security defaults to Disabled.
Select a reason from the dropdown. Choose My organization is using Conditional Access.
Click Save.
Confirm that the Security Defaults panel now shows as Disabled.

Why disable Security Defaults?

Security Defaults enforce MFA for every user in the tenant. That's a solid baseline, but it's an all-or-nothing approach.

Conditional Access lets you target MFA to specific roles, users, or conditions. You can't have both active at the same time, so Security Defaults must be turned off first.

Don't see the Manage security defaults link?

Make sure you are on the Properties page under Identity > Overview. The link is at the very bottom of the page, so you may need to scroll down.

Help me find and disable Security Defaults in the Entra admin center

Assign the P2 license to your admin account

Your admin account needs a P2 license assigned directly to it. Without this, you won't be able to configure P2 features like Conditional Access and PIM.

In the left navigation, expand Identity and select Users.
Click All users.
Click on your current admin user account in the list.
In the left pane, select Licenses.
Click + Assignments.
Check the box next to Microsoft Entra ID P2.
Click Save.

You should see Microsoft Entra ID P2 listed in your license assignments.

Not seeing the P2 license in the assignments list?

Make sure you activated the P2 trial in the previous substep. Navigate back to Licenses > All products and confirm that Microsoft Entra ID P2 appears there before attempting to assign it.

I activated the P2 trial but can't assign the license to my user account

Your tenant is now running Entra ID P2 with Security Defaults out of the way. Next up, you'll create the user accounts and security groups that form your organization's identity structure.

Create Users and Security Groups

Your tenant is ready with the Entra ID P2 trial activated and Security Defaults disabled. Now it's time to build the identity structure that forms the foundation of your Zero Trust lab.

You'll create two user accounts that follow a common enterprise pattern called least privilege. One account holds a permanent admin role for emergency access. The other starts with zero admin privileges and will only gain elevated access through a just-in-time request process in a later step.

In this step, get ready to:

Create the DedicatedAdmin account with a permanent Global Administrator role.
Create the TemporaryAdmin account with no standing admin privileges.
Register both accounts for MFA using the Microsoft Authenticator app.

Create the DedicatedAdmin user

The DedicatedAdmin account represents a permanent Global Administrator. In real enterprises, this type of account is known as a break-glass account for emergency access when other admin pathways are unavailable.

In the Entra admin center, expand Identity in the left navigation.
Select Users, then click All users.
Click + New user at the top of the page.
Select Create new user.

In the User principal name field, enter DedicatedAdmin.
In the Display name field, enter DedicatedAdmin.
Under Password, select Let me create the password.
Enter a strong password and record it somewhere safe. You will need this password to sign in as DedicatedAdmin later.

Click the Properties tab.
Set Usage location to your country.

Why set Usage location?

The Usage location is required before you can assign licenses to a user. Without it, the license assignment step will fail.

Click the Assignments tab.
Click the link next to Role.
Search for Global Administrator and select it.
Click Select.

Click Review + create.
Click Create.

DedicatedAdmin now exists as a user with the Global Administrator role. Next, assign the P2 license so this account can use Conditional Access and PIM features.

Navigate back to All users.
Click on the DedicatedAdmin user.
Select Licenses in the left pane.
Click + Assignments.
Check the box next to Microsoft Entra ID P2.
Click Save.

You should see a notification confirming the license assignment succeeded. The DedicatedAdmin user now has the Global Administrator role and a P2 license.

License assignment failing?

If the license assignment fails, go back to the DedicatedAdmin user profile and confirm that Usage location is set. A missing Usage location is the most common reason license assignments fail.

If you don't see the Microsoft Entra ID P2 license available, make sure you activated the P2 trial in Step 1.

help me fix a license assignment error for my DedicatedAdmin user

What is a break-glass account?

A break-glass account is a permanent admin account that your organization keeps as a backup. If Conditional Access locks out every other admin, or if PIM becomes unavailable, this account can still sign in and restore access.

Microsoft recommends every tenant have at least one break-glass Global Administrator. That is exactly what DedicatedAdmin is in this lab.

Create the TemporaryAdmin user

The TemporaryAdmin account takes a completely different approach. This account starts with no admin privileges at all. It will only gain elevated access through Privileged Identity Management later in the project.

Click + New user at the top of the All users page.
Select Create new user.
In the User principal name field, enter TemporaryAdmin.
In the Display name field, enter TemporaryAdmin.
Under Password, select Let me create the password.
Enter a strong password and record it. You will need this password later as well.

Click the Properties tab.
Set Usage location to your country.

Why no role assignment for TemporaryAdmin?

You are intentionally leaving TemporaryAdmin with the default User role and no admin privileges. This is the core of the least privilege principle. This account will only gain Global Administrator access through PIM, where every elevation requires MFA and a business justification.

Leave the Assignments tab as is. Do not assign any roles.
Click Review + create.
Click Create.

Now assign the P2 license to TemporaryAdmin, just like you did for DedicatedAdmin.

Navigate back to All users.
Click on the TemporaryAdmin user.
Select Licenses in the left pane.
Click + Assignments.
Check the box next to Microsoft Entra ID P2.
Click Save.

Navigate back to All users. You should now see both DedicatedAdmin and TemporaryAdmin listed alongside your original admin account.

Don't see both users listed?

Click the Refresh button at the top of the All users page. New users can take a few seconds to appear.

If a user is missing entirely, repeat the creation steps for that account. Double check that you clicked Create on the final review screen.

help me troubleshoot missing users in the Entra admin center

Register both users for MFA

Both accounts need to complete Multi-Factor Authentication registration before they can be challenged by Conditional Access policies or PIM. You will sign in as each user in a private browser window and register the Microsoft Authenticator app on your phone.

Pro tip: find your tenant domain

When signing in as your new users, you need the full username in the format DedicatedAdmin@yourdomain.onmicrosoft.com. Your tenant domain is shown in the top-right corner of the Entra admin center, or under Identity > Overview.

Open an InPrivate or Incognito browser window by pressing Cmd+Shift+N (macOS) or Ctrl+Shift+N (Windows).
Navigate to https://aka.ms/mfasetup.
Sign in as DedicatedAdmin using the full username (DedicatedAdmin@ followed by your tenant domain) and the password you set earlier.

What about the password change prompt?

The first time you sign in as a new user, you will be prompted to change the password. Set a new password and record it. This is the password you will use for all future sign-ins with this account.

After changing the password, complete the MFA registration wizard.
Select Microsoft Authenticator as your authentication method.
Open the Microsoft Authenticator app on your phone.
In the app, tap + to add a new account, then select Work or school account.
Scan the QR code displayed on the browser screen.
Follow the on-screen prompts to approve the test notification sent to your phone.

You should see a confirmation that MFA registration is complete for DedicatedAdmin.

Close the InPrivate or Incognito window.
Open a new InPrivate or Incognito window.
Navigate to https://aka.ms/mfasetup again.
Sign in as TemporaryAdmin using the full username (TemporaryAdmin@ followed by your tenant domain) and the password you set.
Complete the same password change and MFA registration process using the Microsoft Authenticator app.

Pro tip: keep both passwords handy

You will sign in as DedicatedAdmin and TemporaryAdmin multiple times in the upcoming steps. Keep their updated passwords and your tenant domain written down where you can find them quickly.

Having trouble with MFA registration?

If the QR code scan fails, make sure the Microsoft Authenticator app is up to date on your phone. Try tapping Scan a QR code instead of using the automatic camera.

If you see an error about the account already existing in Authenticator, remove the old entry from the app first, then try scanning again.

If the registration page does not load, confirm you are using an InPrivate or Incognito window. A regular browser window may auto-sign-in with your original admin account.

help me fix MFA registration for my new Entra ID user accounts

Your identity structure is in place and both accounts are MFA-ready. Next up, you'll create Conditional Access policies that enforce MFA whenever a privileged admin signs in.

Configure Conditional Access Policies

Your identity structure is in place with two admin accounts and MFA registered on both. Now it's time to create the first layer of Zero Trust: the policies that decide when MFA is actually required.

Conditional Access is the policy engine in Microsoft Entra ID that evaluates every sign-in attempt. Based on conditions like user role and target app, each policy decides whether to require MFA before granting access.

What is Conditional Access?

Conditional Access policies follow an if-then pattern. If a user matches certain conditions (like holding a privileged directory role), then enforce specific controls (like requiring MFA).

This gives you fine-grained control over who gets challenged and when, instead of applying MFA to every user on every sign-in.

In this step, get ready to:

Create a Conditional Access policy requiring MFA for privileged admin roles.
Test the policy by signing in with both admin accounts.
Review sign-in logs to confirm the policy targets the correct users.

Create the "Require MFA for Admins" policy

This policy targets users who hold privileged directory roles like Global Administrator. When any of these users sign in to a cloud app, the policy requires them to complete MFA before access is granted.

Sign in to the Entra admin center at https://entra.microsoft.com as your original admin account.
In the left navigation, expand Identity.
Select Protection, then click Conditional Access.
Click + Create new policy.
In the Name field, enter CA001: Require MFA for Admins.

Now configure which users the policy applies to.

Under Users, click 0 users and groups selected.
Select the Include tab.
Check Select users and groups.
Check Directory roles.
Select Global Administrator.
Select Security Administrator.
Select User Administrator.
Select Billing Administrator.

Now configure what the policy protects and what it enforces.

Under Target resources, click No target resources selected.
Select the Include tab.
Choose All cloud apps.
Under Grant, click 0 controls selected.
Check Require multifactor authentication.
Click Select.

Exclude your own account before enabling this policy

Your current admin account holds the Global Administrator role. If you enable this policy without excluding yourself, you could get locked out of the Entra admin center the next time your session expires.

The next set of instructions adds an exclusion for your account. Do not skip them.

Under Users, switch to the Exclude tab.
Check Select excluded users and groups.
Search for and select your current admin account.
Scroll down and set Enable policy to On.
Click Create.

Your policy is now live. Any user holding one of those four directory roles will be required to complete MFA when they sign in to any cloud app.

Why these four directory roles?

Global Administrator, Security Administrator, User Administrator, and Billing Administrator are the most powerful roles in Microsoft Entra ID. A compromised account with any of these roles could modify tenant settings, reset passwords, or access billing data.

Requiring MFA for these roles is a Microsoft best practice and one of the first controls auditors check during security reviews.

Test the Conditional Access policy

The best way to confirm a Conditional Access policy works is to test it with two accounts. One account should trigger the policy, and the other should not.

Open an InPrivate (Edge) or Incognito (Chrome) browser window.
Navigate to https://portal.azure.com.
Sign in as DedicatedAdmin using the password you set in Step 2.

You should be prompted for MFA before gaining access. Complete the MFA challenge using the Microsoft Authenticator app on your phone.

Open another InPrivate or Incognito browser window.
Navigate to https://portal.azure.com.
Sign in as TemporaryAdmin using the password you set in Step 2.

You should not be prompted for MFA. TemporaryAdmin does not hold any privileged directory role, so the Conditional Access policy does not apply to this account.

What do these results prove?

DedicatedAdmin holds the Global Administrator role, which matches the policy's include condition. The policy fires and requires MFA. TemporaryAdmin is a standard user with no directory role, so the policy ignores them entirely.

This is exactly the behavior you want. Privileged accounts are challenged. Standard accounts are not.

Not seeing the MFA prompt for DedicatedAdmin?

Make sure you disabled Security Defaults in Step 1. Conditional Access policies cannot run while Security Defaults are enabled.
Confirm that DedicatedAdmin has the Global Administrator role assigned. The policy targets directory roles, not individual users.
Close all browser windows and open a fresh InPrivate or Incognito session. Cached sessions can bypass the policy check.
Make sure the policy is set to On, not Report-only. Report-only mode logs the policy evaluation but does not enforce it.

Help me troubleshoot why my Conditional Access policy is not prompting for MFA when signing in as DedicatedAdmin.

Review the sign-in logs

Sign-in logs record every authentication attempt and show which Conditional Access policies were evaluated. This is how you verify that your policy is scoped correctly to privileged roles only.

Back in the Entra admin center as your original admin, expand Identity in the left navigation.
Select Monitoring & health, then click Sign-in logs.
Find the recent sign-in entry for DedicatedAdmin.
Click on the entry, then select the Conditional Access tab.

You should see CA001: Require MFA for Admins listed with a result of Success. This means the policy was applied and MFA was completed.

Close this entry and find the recent sign-in entry for TemporaryAdmin.
Click on it and select the Conditional Access tab.

You should see CA001 listed with a result of Not applied. TemporaryAdmin does not hold a privileged role, so the policy correctly skipped this user.

Why do sign-in logs matter?

Sign-in logs are your audit trail proving that Conditional Access policies are targeting the right users. In production, security teams review these logs during compliance audits to confirm that privileged access is properly controlled.

The two results you just verified (applied for DedicatedAdmin, not applied for TemporaryAdmin) are exactly the evidence an auditor looks for.

Not seeing the sign-in entries?

Sign-in logs can take a few minutes to populate. Wait 2-3 minutes and refresh the page.
Use the filters at the top of the sign-in logs page. Filter by username (DedicatedAdmin or TemporaryAdmin) to narrow the results.
Make sure you are viewing the Interactive sign-in logs tab, not Non-interactive.

Help me find the sign-in log entries for my test accounts.

Your Conditional Access policies are live and verified through sign-in logs. Next up, you'll configure Privileged Identity Management to eliminate standing admin privileges entirely and replace them with just-in-time access.

Set Up Privileged Identity Management (PIM)

Your Conditional Access policies are live. Any user holding a privileged admin role now needs to complete MFA before accessing cloud apps.

There is still a gap in your security posture. The DedicatedAdmin account holds the Global Administrator role around the clock. If that account gets compromised, the attacker has full admin access until someone notices. Privileged Identity Management closes this gap by replacing standing privileges with just-in-time, time-bound access.

In this step, get ready to:

Open PIM and navigate to the Global Administrator role.
Add TemporaryAdmin as an eligible member for Global Administrator.
Review the PIM activation settings that enforce MFA and time-bound access.

Open PIM and navigate to Entra ID roles

PIM lives under the Identity governance section of the Entra admin center. You will start by navigating to the Global Administrator role to see who currently holds it.

In the Entra admin center, expand Identity governance in the left navigation.
Click Privileged Identity Management.
Under Manage, click Microsoft Entra roles.
Click Roles to see the list of directory roles.
Find and click Global Administrator to view its current assignments.

You should see DedicatedAdmin listed as an active (permanent) Global Administrator. TemporaryAdmin does not appear here yet.

Don't see Privileged Identity Management in the menu?

PIM requires an Entra ID P2 license. If the option does not appear, your P2 trial may not have fully propagated yet. Wait a few minutes and refresh the page.

Also confirm that the P2 license is assigned to your current admin account under Users > Licenses.

Why can't I find Privileged Identity Management in the Entra admin center?

Add TemporaryAdmin as an eligible member

An "eligible" assignment means the user does not hold the role by default. They must request activation through PIM each time they need it. This is the core of the Zero Trust just-in-time access model.

Click + Add assignments.
On the Membership tab, click Select member(s).
Search for TemporaryAdmin and select the account.
Click Next.
On the Setting tab, confirm that Assignment type is set to Eligible.
Leave Permanently eligible checked.
Click Assign.

You should now see TemporaryAdmin listed under the Eligible assignments tab for the Global Administrator role.

What is the difference between eligible and active?

An active assignment means the user holds the role right now with full permissions.
An eligible assignment means the user can request the role, but does not hold it until they activate through PIM.
This distinction is what eliminates standing admin privileges. No one has permanent access they do not currently need.

TemporaryAdmin not showing up in the member search?

Make sure you are searching by the display name TemporaryAdmin exactly as you created it in Step 2. The search is case-sensitive.

Also verify that the Entra ID P2 license is assigned to the TemporaryAdmin account. PIM requires a P2 license on both the administrator configuring PIM and the user receiving the eligible assignment.

Why can't I find TemporaryAdmin when adding a PIM eligible assignment?

Review the PIM role settings

PIM has default activation requirements for each role. These settings control what happens every time someone requests elevated access.

In the Microsoft Entra roles section, click Settings in the left pane.
Find and click Global Administrator in the list.
Review the activation requirements on the settings page.

Confirm the following defaults are in place:

Activation maximum duration is set to 8 hours.
On activation, require is set to Azure MFA.
Require justification on activation is set to Yes.

What do these settings mean?

Every time TemporaryAdmin wants Global Administrator access, they must complete MFA verification through the Microsoft Authenticator app.
They must also provide a written business justification explaining why they need the elevated role.
The access automatically expires after 8 hours, returning the user to standard privileges with no manual intervention required.

Why just-in-time access instead of permanent roles?

Permanent admin roles are a high-value target for attackers. If an account with standing Global Administrator access is compromised, the attacker has full control immediately. With PIM, even a compromised eligible account is useless without passing MFA and providing a justification. The attacker's window shrinks from "always" to "never" unless they can also defeat MFA.

PIM is configured and ready to go. Next up, you will sign in as TemporaryAdmin and test the full privileged access workflow from start to finish.

Test the Full Privileged Access Workflow

In the previous step, you configured PIM and made TemporaryAdmin eligible for the Global Administrator role. The setup is complete, but you haven't proven it works yet.

Now you will sign in as TemporaryAdmin and walk through the complete elevation workflow. This is the ultimate test of your Zero Trust configuration.

In this step, get ready to:

Request role activation as TemporaryAdmin through PIM.
Complete MFA and provide a business justification to activate the role.
Verify elevated access and confirm that the role expires automatically.

Request role activation as TemporaryAdmin

TemporaryAdmin has no standing admin privileges. The only way this account can access the Global Administrator role is through PIM's just-in-time activation process.

Open an InPrivate (Edge) or Incognito (Chrome) browser window.
Navigate to https://entra.microsoft.com.
Sign in as TemporaryAdmin using the credentials you created in Step 2.
Complete MFA if prompted.
In the left navigation, expand Identity governance.
Click Privileged Identity Management.
Under Tasks, click My roles.

Under Eligible assignments, you should see Global Administrator listed. This confirms that the PIM assignment you created in Step 4 is working.

Click Activate next to the Global Administrator role.

What does Activate do?

Clicking Activate starts a PIM activation request. PIM does not grant the role immediately. It first requires you to verify your identity and explain why you need the access.

Don't see Global Administrator under Eligible assignments?

Make sure you are signed in as TemporaryAdmin, not your original admin account or DedicatedAdmin. Only TemporaryAdmin was assigned an eligible role in Step 4.

If the eligible assignment is missing, go back to Step 4 and verify that TemporaryAdmin appears under Eligible assignments for the Global Administrator role in the PIM admin view.

PIM eligible role not showing up for TemporaryAdmin

Complete MFA and provide justification

PIM requires two things before granting privileged access: proof of identity through MFA, and a written business justification. This ensures that every elevation is both authenticated and auditable.

You will be prompted for MFA verification. Complete it using the Microsoft Authenticator app on your phone.
In the Reason text box, enter a justification such as: Need to review tenant security settings for quarterly audit.
Click Activate.

Wait for the activation to complete. A banner should appear confirming that your roles have changed.

Click the Active assignments tab.
Verify that Global Administrator now shows as Activated with a time-bound expiration.

What just happened?

PIM granted TemporaryAdmin the Global Administrator role for a limited time window (up to 8 hours by default). This is just-in-time access in action.

The justification you entered is recorded in the audit log. In a real enterprise, security teams review these logs to track who elevated their privileges and why.

Activation stuck or failing?

PIM activations can take 30 seconds to a few minutes to process. If the banner does not appear, refresh the page and check the Active assignments tab again.

If the activation fails entirely, confirm that TemporaryAdmin has a Microsoft Entra ID P2 license assigned. PIM requires a P2 license on the user requesting activation.

PIM activation is failing or stuck for TemporaryAdmin

Verify elevated access and confirm expiration

The activation gave TemporaryAdmin time-bound Global Administrator access. Now you will prove that the elevated privileges actually work, and then confirm that PIM enforces automatic expiration.

While still signed in as TemporaryAdmin, expand Identity in the left navigation.
Click Users, then All users.

You should see the full list of users in your tenant. The ability to view and manage users requires admin privileges. Before this activation, TemporaryAdmin could not access this page.

Why does this matter?

This is the difference between eligible and active access. Before PIM activation, TemporaryAdmin was a standard user with no admin capabilities. After activation, they have full Global Administrator privileges. The key is that this access is temporary and auditable.

Navigate back to Identity governance > Privileged Identity Management.
Under Tasks, click My roles.
Click the Active assignments tab.
Note the expiration time displayed next to the Global Administrator role.

After this expiration time passes, the role automatically deactivates. TemporaryAdmin returns to being a standard user with no admin privileges. No one has to remember to revoke the access.

What is least privilege in practice?

This is exactly how enterprises enforce the principle of least privilege. Administrators only have elevated access for the exact window they need it. The rest of the time, their accounts are no more powerful than any other user in the organization.

Sign out of the TemporaryAdmin session by clicking the account icon in the top right corner.
Click Sign out.
Close the InPrivate/Incognito window.

Pro tip: check the audit log

Sign back in to the Entra admin center as your original admin account and navigate to Identity governance > Privileged Identity Management > Microsoft Entra roles > Resource audit. You will see a full record of TemporaryAdmin's activation, including the justification they provided and the exact time window of the access.

Secret mission

Risk-Based Conditional Access and the What If Tool

Your Conditional Access policies enforce MFA based on static role assignments. But what happens when a sign-in itself looks suspicious? Configure Identity Protection to respond to risky sign-ins automatically, then use the What If tool to simulate how all your policies interact.

Before you go

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project uses the Entra ID P2 free trial, which expires automatically after 30 days with no charges.

Cost warning

The Entra ID P2 trial is free for 30 days and expires automatically. After expiration, P2 features like PIM, Conditional Access, and Identity Protection become unavailable. If you want to continue using these features beyond the trial, you would need to purchase P2 licenses at $9.00 per user per month. The user accounts and basic Entra ID Free features remain available at no cost.

Resources you used:

Microsoft Entra ID P2 trial license (assigned to your admin account, DedicatedAdmin, and TemporaryAdmin).
DedicatedAdmin user account (permanent Global Administrator).
TemporaryAdmin user account (PIM-eligible, no standing privileges).
Conditional Access policy: CA001 (Require MFA for Admins).
Conditional Access policy: CA007 (Require MFA for Risky Sign-ins, if created during the Secret Mission).
PIM eligible role assignment for TemporaryAdmin as Global Administrator.
Disabled Security Defaults on your tenant.

Keep everything running

No action needed. Choose this if you're still actively building or want to continue exploring Entra ID features within the 30-day trial window.

Your P2 trial remains active for 30 days from the date of activation.
User accounts, Conditional Access policies, and PIM configurations stay in place at no cost.
After the trial expires, P2 features stop working. Your tenant and user accounts remain intact with Entra ID Free features.

Pause - I'll come back to this later

Your Entra ID resources are configuration-based. There are no running processes or compute resources to shut down.

The P2 trial cannot be paused. The 30-day countdown continues from the date you activated it.
Consider setting a calendar reminder for your trial expiration date so you can decide whether to purchase licenses or let the features expire.
Your user accounts, policies, and PIM configurations remain in place until you choose to delete them.

Delete - I don't want to use this again

Remove all project resources from your Entra ID tenant. Follow these steps in the Entra admin center.

Navigate to All users and delete the DedicatedAdmin and TemporaryAdmin user accounts.
Navigate to Conditional Access and delete the CA001: Require MFA for Admins policy.
If you created CA007: Require MFA for Risky Sign-ins during the Secret Mission, delete that policy as well.
Navigate to Privileged Identity Management, open Microsoft Entra roles, select Global Administrator, and remove the eligible assignment for TemporaryAdmin.
Re-enable Security Defaults if desired. Navigate to Properties under your tenant overview, click Manage security defaults, and set it back to Enabled.
The P2 trial expires automatically after 30 days. No action is needed to cancel it.

Mission accomplished

That's a Wrap!

Nice work! You just built a Zero Trust identity security lab from scratch using Microsoft Entra ID. This is the exact pattern enterprises use to secure privileged access in production Azure environments.

Here's what you learned:

Built an organizational identity structure with dedicated admin accounts and security groups following least privilege principles.
Configured Conditional Access policies that enforce MFA for all privileged admin roles and validated enforcement through sign-in logs.
Set up Privileged Identity Management (PIM) for just-in-time Global Administrator access and tested the full elevation workflow from request to automatic expiration.
Secret Mission: Created a risk-based Conditional Access policy using Identity Protection and explored the What If tool to simulate how policies interact across different access scenarios.

Ready to quiz yourself?