Entra Identity Recovery Lab

Diagnose Entra sign-ins, delegate helpdesk roles, and document recovery.

Introduction

30 Second Summary

A password complaint can send a helpdesk straight to the reset button. The real cause could be a disabled account or missing administrative permission.

In this project, you will operate the fictional Northstar Parcel helpdesk inside a safe Microsoft Entra lab. You will diagnose Maya Chen's sign-in failures before deciding whether a password reset is justified.

What You'll Build

You'll demonstrate a recovery case where the logs explain each failure before the corrective action appears in your private incident runbook.

By the end of this project, you'll have:

A safe identity recovery lab where you can find Maya Chen and Jordan Lee in the Microsoft Entra admin center or through PowerShell.
An evidence-led workflow that separates authentication failures from authorization failures before you choose a remedy.
A private GitHub incident runbook that explains the recovery without exposing credentials or tenant identifiers.
Secret Mission: Triage an ambiguous login ticket with evidence before adding a reusable decision tree to the README.

Are there any prerequisites?

This project requires a Mac with internet access. If you need a new Azure account, have a phone number, a non-prepaid credit or debit card, and a Microsoft or GitHub account ready.

Use only a dedicated lab tenant because the walkthrough changes test identities and administrative roles.

Before We Start

Before any hands-on work, commit to building a safe fictional Microsoft Entra identity recovery lab. Your guiding rule is to check sign-in evidence and account state before choosing a password reset.

Prepare the Lab Tenant and Mac Tooling

Identity recovery work can change real user access. A safe lab keeps those experiments away from anyone's working account.

This step establishes a dedicated Microsoft Entra ID Free tenant with a bootstrap administrator.

You will also verify PowerShell 7.6.6. Then you will install the Microsoft Graph PowerShell SDK at version 2.39.0.

In this step, get ready to:

Confirm a dedicated lab tenant with a bootstrap account holding the Global Administrator role.
Install PowerShell 7.6.6 on your Mac.
Establish an authenticated Microsoft Graph session with the pinned SDK.

Confirm your lab tenant

A tenant is the directory boundary that contains identities plus administrative roles. Your recovery exercises need a dedicated non-production tenant so every change stays inside the fictional lab.

Keep This Lab Isolated

Use only a dedicated test tenant for this project. Do not create or modify identities in an employer tenant or any production environment.

Choose the tab that matches your current tenant access.

✔️ I already have a lab tenant

Visit the Microsoft Entra admin center in your browser.
Sign in with your lab-only bootstrap account.
Select the Settings icon in the top menu.
Select Directories + subscriptions.
Switch to your dedicated Microsoft Entra ID Free lab tenant.

You should see the lab tenant name in the admin center. This confirms that your next actions stay inside the intended directory.

Select Entra ID in the left menu.
Select Users.
Select your bootstrap administrator account.
Select Assigned roles.

You should see Global Administrator in the role list. Keep the Microsoft Entra admin center open for the rest of the lab.

ⓧ I need a lab tenant

About the Card Verification

Creating an Azure free account requires a phone number plus a non-prepaid credit or debit card. Azure can place a temporary $1 authorization hold during card verification.

The hold is reversed after verification. This project creates no Azure compute, storage, or networking resources.

Visit the Azure free account page in your browser.
Sign in with a Microsoft account or GitHub account.
Provide your phone number when the signup process requests verification.
Provide a non-prepaid credit or debit card for the authorization check.
Complete the Azure free account signup.

The signup gives you a default Microsoft Entra ID Free tenant. The account that created it becomes your lab bootstrap administrator.

Visit the Microsoft Entra admin center.
Sign in with the account that completed the Azure signup.
Select Entra ID in the left menu.
Select Users.
Select your bootstrap administrator account.
Select Assigned roles.

You should see Global Administrator in the role list. Keep this lab tenant open in the Microsoft Entra admin center.

Cannot Confirm Global Administrator?

Confirm that you selected the dedicated lab tenant in Directories + subscriptions.
Use the account that originally created the lab tenant.
Create a separate lab tenant through the Azure free account path if your current account belongs to an employer environment.

Still blocked? Help me confirm my lab tenant and bootstrap administrator access.

Install PowerShell 7.6.6

PowerShell gives you a repeatable command interface for checking the directory. The signed macOS package must match your Mac's processor.

Press Cmd+Space to open Spotlight.
Type Terminal.
Press Enter to open Terminal.
Check whether PowerShell is already installed by running this command:

pwsh --version

What Does This Command Check?

The command asks the installed PowerShell executable to report its version. Its result tells you whether the correct release is ready or whether installation is required.

✔️ I see PowerShell 7.6.6

PowerShell is ready. You have the exact version used throughout this project.

ⓧ I see an older version

A newer stable PowerShell 7 package replaces the existing stable PowerShell 7 installation. The installer asks for your Mac administrator password only to authorize the local software change.

Visit the official PowerShell release page for version 7.6.6.
Download powershell-7.6.6-osx-arm64.pkg for Apple silicon or powershell-7.6.6-osx-x64.pkg for an Intel Mac.
Open the downloaded package from your browser's download list.
Complete the package installer using its default destination.
Approve the local installation with your Mac administrator password when prompted.
Return to Terminal.
Run the version check shown above again.

You should now see PowerShell version 7.6.6.

ⓧ Command not found

Terminal cannot find PowerShell yet. The signed macOS package adds the pwsh executable to your Mac.

The installer asks for your Mac administrator password. This authorizes the local software installation.

Visit the official PowerShell release page for version 7.6.6.
Download powershell-7.6.6-osx-arm64.pkg for Apple silicon or powershell-7.6.6-osx-x64.pkg for an Intel Mac.
Open the downloaded package from your browser's download list.
Complete the package installer using its default destination.
Approve the local installation with your Mac administrator password when prompted.
Return to Terminal.
Run the version check shown above again.

You should now see PowerShell version 7.6.6.

Still Missing PowerShell 7.6.6?

Confirm that the downloaded package name contains 7.6.6.
Confirm that you selected the Arm64 package for Apple silicon or the x64 package for Intel.
Close Terminal after installation if it still cannot find pwsh.

Need another pair of eyes? Help me diagnose my PowerShell installation on macOS.

Establish the Microsoft Graph session

The Microsoft Graph PowerShell SDK lets PowerShell read data from your lab directory. The User.Read.All scope authorizes this session to read user information.

Return to Terminal.
Start PowerShell by running this command:

pwsh

What Does This Command Do?

The pwsh command starts PowerShell inside Terminal. The new prompt is where you run Microsoft Graph commands.

You should see a PowerShell prompt ready for your next command.

Check whether the pinned Microsoft Graph SDK is installed by running:

Get-InstalledModule Microsoft.Graph

What Does This Command Check?

The command looks for the installed Microsoft Graph package. Its output includes the package name plus its installed version.

✔️ I see Microsoft.Graph 2.39.0

The pinned SDK is ready. You can continue to the lab-tenant connection.

ⓧ I see another version

The project uses SDK version 2.39.0 so every command matches the same release. This installation can take a few minutes because the package includes several service modules.

PowerShell may request confirmation for the package source. Prepare to approve that source if the prompt appears.

Install the pinned SDK by running:

Install-Module -Name Microsoft.Graph -RequiredVersion 2.39.0

What Does This Command Install?

The command installs Microsoft.Graph at the required version. The package includes the authentication plus user modules needed for this lab.

Approve the package-source confirmation if PowerShell displays one.
Run the module check shown above again after installation finishes.

You should now see Microsoft.Graph version 2.39.0.

ⓧ The module is not installed

The SDK needs to be added before PowerShell can reach Microsoft Graph. The download can take a few minutes while its service modules install.

PowerShell may request confirmation for the package source. Prepare to approve that source if the prompt appears.

Install the pinned SDK by running:

Install-Module -Name Microsoft.Graph -RequiredVersion 2.39.0

What Does This Command Install?

The command installs Microsoft.Graph at version 2.39.0. Its service modules provide the commands used to authenticate plus read lab users.

Approve the package-source confirmation if PowerShell displays one.
Run the module check shown above again after installation finishes.

You should now see Microsoft.Graph version 2.39.0.

Microsoft.Graph Installation Failed?

Confirm that your Mac has an active internet connection.
Confirm that the current Terminal prompt belongs to PowerShell.
Retry the installation after any package-source confirmation has been approved.

Still stuck? Help me troubleshoot the Microsoft.Graph 2.39.0 installation.

The SDK is installed locally. Your next command creates an authenticated session with read access to users in the lab tenant.

A browser sign-in starts during this command. Use the lab bootstrap administrator so the session connects to the dedicated test tenant.

Start the Microsoft Graph authentication flow by running:

Connect-MgGraph -Scopes 'User.Read.All'

What Does This Connection Do?

The Connect-MgGraph command establishes an authenticated Microsoft Graph session. The requested User.Read.All scope permits user-directory reads for the inventory work in the next step.

Complete the browser sign-in with the lab bootstrap administrator.
Review the requested user-read permission if a consent screen appears.
Approve the requested permission for the lab tenant.

PowerShell returns to its prompt after authentication completes. That's the tooling ready: your lab administrator now has an authenticated Microsoft Graph session.

Connected to the Wrong Tenant?

Close the browser authentication window if it shows an employer account.
Start the connection command again.
Choose the bootstrap account from your dedicated lab tenant.

Need help separating the accounts? Help me connect Microsoft Graph to my lab tenant safely.

Before the final check, which tenant plus SDK version do you expect to see?

Return to the Microsoft Entra admin center from earlier.
Confirm that your dedicated lab tenant remains selected.
Return to the PowerShell prompt in Terminal.
Verify the installed SDK version one final time by running:

Get-InstalledModule Microsoft.Graph

What Confirms the SDK Version?

The output identifies the installed Microsoft.Graph package. The version column provides the final pinned-version check.

You should see version 2.39.0 in the output. Your lab tenant should remain open in the Microsoft Entra admin center.

✔️ My setup matches

Great. Your isolated tenant plus Mac administration tools are ready for the Northstar Parcel identities.

ⓧ I'd like to double check the full setup

Lab-only bootstrap account with Global Administrator access, signed in to the Microsoft Entra admin center and authenticated to Microsoft Graph PowerShell.

Dedicated non-production Microsoft Entra ID Free tenant accessed through the Microsoft Entra admin center.

Authenticated lab-tenant session created with Connect-MgGraph -Scopes 'User.Read.All'.

Version 2.39.0 installed and verified with Get-InstalledModule Microsoft.Graph.

PowerShell 7.6.6 installed on macOS and available through pwsh.

Your isolated administration workspace is ready. Next, you will create Maya Chen plus Jordan Lee inside the Northstar Parcel lab.

Build the Northstar Parcel Identity Lab

Your isolated Microsoft Entra tenant is ready. The directory still needs fictional users with contrasting account states.

You'll create two cloud identities for Northstar Parcel. Maya Chen represents an employee whose account is deliberately disabled.

Jordan Lee represents a helpdesk trainee with no administrative role. Together, the accounts let you test authentication before examining authorization.

In this step, get ready to:

Explain the boundary between authentication and authorization.
Create two internal member users with contrasting account states.
Verify both identities through the portal and PowerShell.

Define the identity boundary

Authentication proves the identity of a user. Authorization determines what that authenticated identity may do.

Document one sentence for each concept in the checkpoint below.

Create the two test identities

A controlled identity incident begins with a known account state. Maya starts disabled so you can test diagnosis before attempting a password reset.

Jordan starts enabled so his identity can authenticate later. His lack of an administrative role creates a separate authorization boundary.

Keep Lab Credentials Private

Credential screens can feel high stakes. These accounts are isolated to your non-production lab.

Keep each temporary password outside your project notes or repository.
Store each sign-in name beside its matching password in your password manager.

In the Microsoft Entra admin center from earlier, select Entra ID.
Select Users.

You should see the user directory for your lab tenant.

Select New user.
Select Create new user.

You should see the form for creating an internal user.

Enter Maya Chen as the display name.
Enter maya.chen@your-lab-domain.onmicrosoft.com as Maya's lab sign-in name.

The form now identifies Maya as the Northstar Parcel employee account.

Keep Maya configured as an internal member user.
Clear Account enabled.

Why Clear Account Enabled?

Clearing Account enabled creates a known account-state difference. This gives you a safe failure to investigate in the next step.

Submit the completed form to create Maya's account.

The portal shows Maya's temporary password. This confirms that the internal user was created.

Store Maya's temporary password with her sign-in name in your password manager.
Return to the Users page.

Maya now appears in the directory. Her account remains disabled.

Select New user.
Select Create new user.

You should see a fresh internal-user form for Jordan.

Enter Jordan Lee as the display name.
Enter jordan.lee@your-lab-domain.onmicrosoft.com as Jordan's lab sign-in name.

The form now identifies Jordan as the Northstar Parcel helpdesk trainee.

Keep Jordan configured as an internal member user.
Keep Account enabled selected.

Jordan's enabled state gives the lab an account that can attempt authentication.

Submit the completed form to create Jordan's account.

The portal shows Jordan's temporary password. This confirms that the second internal user was created.

Store Jordan's temporary password with his sign-in name in your password manager.
Return to the Users page.

Both Northstar Parcel identities now appear in your lab directory. Maya is disabled while Jordan is enabled.

Predict and verify the identity inventory

The two accounts now have different authentication states. Neither account has an administrative role.

A directory inventory confirms that both user objects exist. Account state determines each sign-in outcome while role assignments determine administrative authority.

Predict whether Maya can authenticate while Account enabled is cleared.
Predict whether Jordan can authenticate while Account enabled remains selected.
Predict whether either new user can administer another user without an administrative role.

The authenticated Microsoft Graph session from earlier lets PowerShell read the directory without changing either user.

Return to the authenticated PowerShell session from earlier.

Before you run the inventory, which two display names do you expect PowerShell to return?

List every user in the lab directory by running this command:

Get-MgUser -All | Format-List ID, DisplayName, Mail, UserPrincipalName

What Does This Command Confirm?

The Get-MgUser -All portion retrieves every user visible to your authenticated Microsoft Graph session.
The Format-List ID, DisplayName, Mail, UserPrincipalName portion presents the identity fields that help you match each command result with the portal.

You should see one entry for Maya Chen. You should also see one entry for Jordan Lee.

Switch back to the Microsoft Entra admin center from earlier.
Return to the Users page.

The portal list should show Maya Chen plus Jordan Lee.

Match each DisplayName with the PowerShell output.
Match each UserPrincipalName with the PowerShell output.

The values should identify the same two users in both views.

Select Maya Chen from the user directory.
Confirm that Account enabled is cleared.

Maya's profile confirms that the staged employee account is disabled.

Return to the Users page.
Select Jordan Lee from the user directory.

Jordan's profile is now open for the second account-state check.

Confirm that Account enabled remains selected.
Return to the Users page.

That is your first directory cross-check complete. Both identities appear in the portal.

The same identities appear in PowerShell. Maya remains disabled while Jordan remains enabled.

Missing a User from the Inventory?

If one identity is missing from both views, return to the Users page.
Complete the missing user's creation form.
If PowerShell returns no directory users, repeat the Microsoft Graph sign-in from the previous step.

Still stuck? Help me compare my Entra user list with my Microsoft Graph PowerShell inventory.

Your Northstar Parcel identity lab is ready. Next, you'll attempt Maya's sign-in.

The evidence will explain the result before you change anything.

Diagnose the Login Failure

Your Northstar Parcel identities are now visible in the portal and PowerShell. Maya's staged account state gives you a controlled incident to investigate.

A login complaint does not prove the password is wrong. You'll use Safari and Microsoft Entra sign-in logs to identify the cause before choosing a remedy.

In this step, get ready to:

Reproduce Maya's blocked sign-in without changing her password.
Compare the failed sign-in record with Maya's account state.
Correct Maya's account state using the evidence.

Reproduce Maya's sign-in failure

The first attempt creates evidence about where authentication stops. Keeping Maya's password unchanged isolates the account state as the variable under investigation.

Leave the bootstrap administrator session open in its existing browser window.
In Safari, create a private browsing window from the File menu.
Navigate to the Microsoft Entra admin center sign-in page in the private window.

Before Maya signs in, do you expect the credentials to be accepted or blocked?

Enter Maya's user principal name from your identity inventory.
Enter Maya's securely stored initial temporary password.
Submit Maya's sign-in attempt.

You'll see a blocked sign-in with AADSTS50057. This is the intended failure for the investigation.

Record the current timestamp in your private incident notes.
Record Microsoft Entra admin center as the application Maya attempted to access.
Record AADSTS50057 as the visible error.
Write your initial hypothesis in your private incident notes.

Didn't see the expected failure?

Confirm the private Safari window is not using the bootstrap administrator session.
Confirm Maya still has Account enabled cleared in the administrator session.
Check Maya's user principal name against the PowerShell inventory from the previous step.

Still stuck? Help me reproduce Maya's disabled-account sign-in failure safely.

Follow the sign-in evidence

A sign-in log is a system-generated record of the attempted access. Matching it to the browser attempt gives you evidence that remains separate from Maya's description of the problem.

Return to the Microsoft Entra admin center session from earlier.
Select Entra ID in the left navigation.
Select Monitoring & health.
Select Sign-in logs.
Locate Maya's attempt by matching her identity with the recorded timestamp.
Open the matching sign-in entry.

The matching entry connects Maya's browser symptom to a specific Microsoft Entra event. Its detail fields show where the sign-in stopped.

Confirm the error code is AADSTS50057.
Read the recorded Failure reason.
Inspect the recorded timestamp.
Inspect the recorded application.
Inspect the Request ID.
Inspect the Correlation ID.

The error code identifies the account as disabled. The failure reason should confirm the same account-state problem.

Return to Users under Entra ID.
Select Maya Chen.
Locate Account enabled in Maya's account properties.
Confirm the property is cleared.
Write your diagnosis before changing Maya's account.

What does this evidence prove?

The error AADSTS50057 means UserDisabled.
The cleared Account enabled property independently confirms the disabled state.
A password reset cannot change the disabled state.
The evidence supports re-enabling the account when the disabled state is unintended.

Correct Maya's account state

The browser failure and account property point to the same cause. The narrow correction is to re-enable Maya while preserving the original password for the retest.

Enable Maya's account by selecting Account enabled in her account properties.
Save Maya's updated account properties.

Maya's user page should now show Account enabled as selected.

Before you retry the sign-in, do you expect the same disabled-account error to appear?

Return to Maya's private Safari window.
Retry Maya's sign-in with the same user principal name and original temporary password.

You'll progress beyond the disabled-account failure. The browser should move to the required first-sign-in password change or security registration.

Complete Maya's required first-sign-in password change.
Complete any required security registration if Microsoft Entra prompts you.

Maya now completes the sign-in flow without AADSTS50057. That is the recovery win: correcting the account state allowed the same original credentials to advance.

Why did the password stay unchanged?

The evidence identified a disabled account as the root cause. Re-enabling Maya directly corrected that state.

No administrator reset was needed for this incident. Maya used the normal first-sign-in flow to replace her temporary password after the account became available.

Still seeing the disabled-account failure?

Confirm Maya's properties still show Account enabled as selected.
Start a fresh Safari private window before retrying the sign-in.
Verify Maya's user principal name against the identity inventory.

Need another pair of eyes? Help me check why Maya still receives AADSTS50057 after I enabled her account.

Maya's incident proves that evidence can prevent the wrong remediation. Next, Jordan will test the boundary between signing in and having permission to reset another user.

Delegate Least-Privilege Recovery

Your last Microsoft Entra investigation showed why evidence comes before a password reset. Your diagnosis restored Maya's access without changing a valid password.

Authentication proves who Jordan is. Authorization controls which administrative actions he may perform.

In this step, get ready to:

Test Jordan's starting access after a successful sign-in.
Delegate only the access needed for recovery work.
Use sign-in evidence to choose the corrective action for Maya.

Test Jordan's starting access

Jordan starts as an enabled internal member with no administrative role. This clean starting point lets you test what successful authentication grants by itself.

Create a separate private session in Safari for Jordan.
Sign in with Jordan's lab account.
Complete the required first-sign-in password change if prompted.
Complete any required security registration if prompted.
Store Jordan's current lab password in your secure password manager.

That first boundary is proven: Jordan can authenticate as himself.

Before you try the reset, decide whether a successful sign-in gives Jordan permission to change Maya's password.

Go to the Microsoft Entra admin center in Jordan's private session.
Select Entra ID.
Select Users.
Select Maya Chen.
Try to select Reset password.

Jordan cannot complete the password reset. This intended shortfall exposes an authorization boundary.

What Did the Failed Reset Prove?

Authentication confirmed Jordan's identity when his sign-in succeeded. Authorization still denied the administrative action because Jordan had no matching role.

This failed reset gives you a clear before-state. You can now measure exactly what changes after delegation.

Assign Jordan's recovery roles

The failed attempt gives you a clear baseline. Least privilege grants only the permissions required for a specific responsibility.

Return to the bootstrap administrator session from earlier.
Select Entra ID.
Select Roles & admins.
Find Password Administrator in the role list.
Select Password Administrator.
Select Add assignments.
Choose Jordan Lee.
Select Add.

The first delegation is in place: Jordan Lee is now listed in the Password Administrator assignments.

Return to Roles & admins.
Find Reports Reader in the role list.
Select Reports Reader.
Select Add assignments.
Choose Jordan Lee.
Select Add.

Jordan Lee is now listed in the Reports Reader assignments. His delegated access covers both recovery work and evidence review.

Why These Two Roles?

Password Administrator gives Jordan the password-reset capability needed for Maya's non-administrator account.

Reports Reader gives Jordan read-only access to sign-in logs. It also gives him read-only access to audit logs.

Together these roles support routine recovery without giving Jordan broad tenant control.

Close Jordan's earlier private session.
Create a fresh private Safari session for Jordan.
Sign in with Jordan's lab account.
Select Entra ID.
Select Users.
Select Maya Chen.
Confirm that Reset password is available without selecting it.

Jordan's fresh session now exposes the delegated reset action. The denied starting state has changed without granting Global Administrator.

Still Unable to See the Reset Action?

Return to the bootstrap administrator session.
Confirm that Jordan Lee appears in the Password Administrator assignments.
Confirm that Jordan Lee appears in the Reports Reader assignments.
Close Jordan's current private session.
Create another fresh Jordan session.

Still stuck? Help me check Jordan's Microsoft Entra role assignments and fresh browser session.

Diagnose and recover Maya's sign-in

A password reset becomes appropriate when the evidence points to failed credential validation. You will create that evidence in the lab before Jordan takes action.

Create a separate private Safari session for Maya.
Enter Maya's lab username on the sign-in page.
Enter an intentionally incorrect password that differs from Maya's real password.

Before you submit the sign-in, predict how this failure's evidence will differ from the earlier disabled-account incident.

Submit Maya's sign-in attempt.

Maya's sign-in fails. The page alone does not provide enough evidence to choose a remedy.

Return to Jordan's fresh session from earlier.
Select Entra ID.
Select Monitoring & health.
Select Sign-in logs.
Refresh the list until Maya's newest attempt appears.
Select Maya's newest sign-in entry.
Inspect the Error code.
Inspect the Failure reason.

You will see AADSTS50126. This code shows that credential validation failed because the submitted username or password was invalid.

Why Does This Evidence Justify a Reset?

The earlier AADSTS50057 evidence pointed to a disabled account. Re-enabling Maya addressed that account-state problem.

The new AADSTS50126 evidence points to invalid credentials. A password reset now addresses the failure shown in the sign-in record.

This part deserves care because the generated password is live immediately. Its value can access Maya's account until she changes it.

Return to Entra ID in Jordan's session.
Select Users.
Select Maya Chen.
Select Reset password.
Store the autogenerated temporary password in your secure password manager.
Keep the temporary password out of notes.
Keep the temporary password out of GitHub.

Jordan has completed the evidence-led reset with delegated privileges. Microsoft Entra now requires Maya to change the autogenerated temporary password during her next sign-in.

Before Maya signs in, predict what Microsoft Entra will require after accepting the temporary password.

Create a fresh private Safari session for Maya.
Enter Maya's lab username.
Enter the temporary password from your secure password manager.
Submit Maya's sign-in.

You will reach the required password-change screen. This confirms that Jordan's reset worked without exposing the temporary credential.

Not Seeing the Password-Change Requirement?

Confirm that you entered the autogenerated temporary password stored after Jordan's reset.
Confirm that Maya's Account enabled property remains selected.
Confirm that Jordan reset Maya Chen instead of another lab user.

Need help? Help me verify Maya's evidence-led password reset without exposing any credentials.

Jordan now has narrow recovery access backed by sign-in evidence. Next, you'll turn the incident trail into a sanitized interview runbook.

Document the Recovery Evidence

Jordan has proved both sides of the access boundary. He authenticated successfully before delegated roles authorized the evidence review and password reset.

Administrative work needs a record showing what happened. You will connect evidence from Microsoft Entra to each decision before publishing a sanitized private GitHub runbook.

In this step, get ready to:

Compare sign-in logs with audit logs while collecting sanitized evidence.
Create a private GitHub repository containing an editable incident runbook.
Explain authentication, authorization, and least privilege through the recovery evidence.

Compare sign-in and audit evidence

Sign-in logs show attempts to access a resource. Audit logs show administrative changes made inside the directory.

Keep the Evidence Interview-Safe

Publishing an incident story can expose more information than intended. Keep only the evidence needed to support your decisions.

Keep time, activity, result, actor role, and target alias.
Exclude passwords, object IDs, tenant IDs, Request IDs, Correlation IDs, IP addresses, and real usernames.
Exclude raw screenshots and exported log files.

Switch back to the fresh Jordan Lee browser session from earlier.
Select Entra ID in the left navigation.
Select Monitoring & health.
Select Sign-in logs.
Locate Maya's disabled-account attempt using its recorded time.
Confirm that the attempt shows AADSTS50057.
Locate Maya's invalid-credential attempt using its recorded time.
Confirm that the attempt shows AADSTS50126.

That comparison gives you two distinct failure stories from the same login complaint. One entry points to account state. The other points to credential validation.

What Do the Sign-In Entries Prove?

The AADSTS50057 entry shows that Maya's disabled account blocked authentication. A password reset would not have changed that account state.

The later AADSTS50126 entry shows that credential validation failed. That evidence supported the password reset Jordan performed.

Return to Monitoring & health.
Select Audit logs.
Locate the event for Maya's account-state change.
Locate Jordan's Password Administrator assignment.
Locate Jordan's Reports Reader assignment.
Locate Jordan's password-reset event for Maya.
Capture each event as time, activity, result, actor role, and target alias in your sanitized evidence summary.
Use role-based aliases for every identity in the summary.

You now have an evidence chain covering the failures, the account-state correction, the delegated roles, and the justified reset. Each administrative decision traces back to a visible fact.

Cannot Find a Matching Event?

Confirm that you are using the Jordan session from earlier.
Match each event against the time when you performed the corresponding lab action.
Check both logs within seven days of the lab activity.

Need help matching the entries? Help me correlate my sanitized Entra evidence.

Create the private GitHub repository

The repository gives your sanitized evidence a durable home. Its README becomes the artifact that connects each decision to the evidence behind it.

A GitHub personal account needs a verified email address. Choose the path that matches your current account state.

✔️ I have a verified GitHub account

ⓧ I need a GitHub account

Visit the GitHub signup page in Safari.
Create a personal account with an email address you can verify.
Complete email verification through the message GitHub sends.

Select New repository in the GitHub web interface.
Enter password-king-entra-recovery as the repository name.
Choose private visibility for the repository.
Turn Add README on.
Select Create repository.

Good progress. You will see the private password-king-entra-recovery repository with README.md in its file list.

Repository Creation Blocked?

Confirm that your GitHub personal account has a verified email address. Account verification must be complete before you create the repository.

Need targeted help? Help me create my private GitHub repository. If account verification still blocks you, share the non-sensitive screen state in the NextWork community.

Write and verify the incident runbook

A README is a Markdown document rendered on the repository page. Your runbook should connect the ticket symptom to a timeline of sanitized evidence.

Select README.md from the repository file list.
Use the file editor control above the rendered README.
Write the ticket symptom at the top in your own words.
Build a sanitized timeline from your sanitized evidence summary.
Use the preview control above the editor.

You will see the ticket symptom followed by a readable timeline. The timeline should cover both failed sign-ins, the account-state correction, both role assignments, and the password reset.

The next section explains why similar symptoms led to different diagnoses. It should also separate Jordan's identity proof from his administrative authority.

Return to the file editor.
Add an authentication-versus-authorization analysis using Jordan's successful sign-in followed by his denied reset attempt.
Add a root-cause section covering the disabled-account incident plus the invalid-credential incident.
Use the preview control above the editor.

You will see two distinct root causes in the preview. The analysis should explain why Jordan's successful authentication did not authorize a password reset.

Each root cause needs a corrective action supported by evidence. The delegated roles also need a clear least-privilege justification.

Return to the file editor.
Add the corrective action that matched each root cause.
Add a least-privilege section explaining the purpose of both delegated roles.
Use the preview control above the editor.

You will see the disabled-account correction tied to AADSTS50057. You will also see the justified password reset tied to AADSTS50126.

How Do the Roles Support Least Privilege?

The Password Administrator role gives Jordan the password-reset capability needed for routine recovery work.

The Reports Reader role gives Jordan read-only access to sign-in and audit evidence. Together these roles avoid using Global Administrator for the delegated helpdesk task.

Your final section turns the incident into an interview answer. A concise response should begin with evidence collection before choosing any reset.

Return to the file editor.
Add a 60-second answer to the question, "How would you troubleshoot a user who says their password does not work?"
Read the interview answer aloud.
Trim the answer to about 60 seconds.
Review the entire file for passwords, object IDs, tenant IDs, Request IDs, Correlation IDs, IP addresses, and real usernames.
Use the page's commit controls to save the README to the current branch.

Before you inspect the finished repository, which required sections do you expect the rendered README to contain?

Return to the repository front page.
Confirm that the repository header identifies it as private.
Review the rendered README.md from top to bottom.

You will see a sanitized incident timeline covering sign-in evidence and administrative changes. The README will also contain both root causes, their corrective actions, an authentication-versus-authorization analysis, a least-privilege explanation, and a 60-second interview answer.

You should find no passwords or tenant-specific identifiers in the rendered file. That confirms the runbook is safe to discuss without exposing the lab tenant.

You have turned the recovery lab into evidence another person can review. Every action in the runbook now connects to a documented reason.

Runbook Missing or Exposing Data?

Return to the file editor if a required section is missing.
Replace every restricted value with a role-based alias or a general description.
Save the corrected README through the page's commit controls.

Need a final sanitization check? Help me review my Entra recovery runbook.

Secret mission

Triage the Ticket Without a Reset Reflex

A ticket says only that Maya cannot sign in. Stage a fresh lab-only fault, diagnose it from Microsoft Entra evidence, choose the narrow correction, and add your reasoning to a reusable decision tree.

Clean Up Your Resources

Choose whether to keep this lab available, place it in a safer paused state, or remove it entirely. Microsoft Entra ID Free and GitHub Free cost $0 for this project because the lab uses no Azure compute, storage, or networking resources.

Resources you used:

Maya Chen and Jordan Lee, two enabled internal member users in your dedicated lab tenant.
Jordan Lee's Password Administrator and Reports Reader role assignments.
The private password-king-entra-recovery repository with its sanitized README.

Microsoft Entra's sign-in logs and audit logs are system-generated records, so they cannot be changed or deleted. Microsoft Entra ID Free retains these records for seven days.

Keep everything running

No action is needed while you are still actively using the lab. This option leaves the identities, delegated roles, and repository available for more practice.

Keep Maya Chen enabled for future sign-in scenarios.
Keep Jordan Lee enabled for future helpdesk scenarios.
Leave Password Administrator and Reports Reader assigned only while Jordan needs delegated access.
Keep the private repository available as your sanitized interview artifact.

Your lab stays ready, but Jordan keeps password-reset access and report visibility.

Pause - I'll come back to this later

A paused lab removes standing privilege without deleting your work. This is the recommended state between projects.

Remove Jordan's delegated roles:

Return to the Microsoft Entra admin center from earlier.
Select Entra ID in the navigation.
Select Roles & admins.
Open Password Administrator.
Select Jordan Lee in the current assignments.
Use the role's assignment removal control to remove Jordan Lee.
Return to Roles & admins.
Repeat the same removal flow for Reports Reader.

Disable Jordan Lee:

Return to Entra ID.
Select Users.
Select Jordan Lee.
Clear Account enabled.
Save the change.

Disable Maya Chen:

Return to Users.
Select Maya Chen.
Clear Account enabled.
Save the change.

Confirm that Jordan Lee no longer appears in either role's current assignments.
Confirm that both lab users show a disabled status.

Your private repository stays intact. The two users cannot sign in until you enable them again.

Delete - I don't want to use this again

This option dismantles the working lab. The order below removes delegated access before the identities, which keeps the cleanup controlled.

Copy any README content you want to keep to a separate location.

Remove Jordan's delegated roles:

Return to the Microsoft Entra admin center from earlier.
Select Entra ID in the navigation.
Select Roles & admins.
Open Password Administrator.
Select Jordan Lee in the current assignments.
Use the role's assignment removal control to remove Jordan Lee.
Return to Roles & admins.
Repeat the same removal flow for Reports Reader.
Skip a role if Jordan Lee no longer appears in its assignments.

Delete Maya Chen:

Return to Entra ID.
Select Users.
Select Maya Chen.
Select Delete.
Confirm the deletion.

Delete Jordan Lee:

Return to Users.
Select Jordan Lee.
Select Delete.
Confirm the deletion.
Confirm that neither identity appears in the active users list.

Both identities should disappear from the active users list. Microsoft Entra keeps deleted users on the Deleted users page for 30 days.

Delete the private repository:

Return to the password-king-entra-recovery repository on GitHub.
Select the repository's settings page.
Locate the destructive actions area.
Choose the repository deletion option.
Follow GitHub's confirmation prompt for password-king-entra-recovery.
Return to your repositories list.
Confirm that password-king-entra-recovery no longer appears.

You should now have no active project identities, delegated role assignments, or private project repository.

Nice Work!

You did it! You built a safe Microsoft Entra identity recovery lab where diagnosis comes before a password reset.

Your Northstar Parcel runbook now proves each recovery decision with sanitized evidence. It gives you a clear 60-second explanation for an interview.

You've learned how to:

Used sign-in evidence to distinguish the disabled-account AADSTS50057 failure from the invalid-credential AADSTS50126 failure. This proved when a password reset was justified.
Demonstrated authentication through Jordan's successful sign-in. Observed an authorization failure when his reset action was denied. Applied least privilege by assigning Password Administrator for recovery actions. Assigned Reports Reader for read-only evidence access.
Verified the Northstar Parcel identities with Microsoft Graph PowerShell from macOS. Published a sanitized GitHub runbook with a recovery timeline. Documented the root cause plus corrective action. Added a 60-second interview answer.
Completed the Secret Mission by independently triaging a new Maya sign-in fault. Added a reusable decision tree that compares account state with credential evidence before choosing a reset.

Ready to quiz yourself?