Posts on Cloud Security Labs

Lab 3: Microsoft Entra Certificate Authentication with PowerShell and Microsoft Graph

Thu, 15 Oct 2026 00:00:00 +0000

Lab 3: Microsoft Entra Certificate Authentication with PowerShell and Microsoft Graph

In this lab I built a small PowerShell tool that logs in to Microsoft Entra ID as an application, not as a person. The tool proves its identity with a certificate, reads the users of my lab tenant through Microsoft Graph, and saves them to a CSV file. After that I deleted the certificate from the app, checked that a new login was rejected, restored the certificate, and cleaned everything up.

Lab 2: Entra App Registration and Employee Portal

Sat, 10 Oct 2026 00:00:00 +0000

Lab 2: Entra App Registration and Employee Portal (Sable Entra Free Student Lab)

[!abstract] Summary Goal: Build an employee portal on a Windows laptop (Node.js, localhost), connect it to an existing Microsoft Entra ID Free tenant, sign in as an employee, and read the profile through Microsoft Graph. Time: about 60 to 90 minutes for a first attempt. Finish the core lab before the optional access-control exercise.

1. Overview

The browser opens a local Node.js app (http://localhost:3000).
The app redirects the browser to Microsoft Entra to authenticate.
After sign-in, Entra sends an authorization code to the app’s registered redirect URI.
The app exchanges the code for tokens and creates a session.
The app calls Microsoft Graph to read the signed-in employee’s profile.

sequenceDiagram
participant B as Browser
participant A as Node.js app (localhost:3000)
participant E as Microsoft Entra
participant G as Microsoft Graph
B->>A: Open site, click Sign in
A->>B: Redirect to Entra
B->>E: Employee authenticates
E->>B: Redirect to /auth/redirect with authorization code
B->>A: Deliver code
A->>E: Exchange code (+ client secret) for tokens
E->>A: ID token + access token
A->>B: Create local session, greet employee
A->>G: Call with access token (User.Read)
G->>A: Employee profile

Runs on your laptop	Runs in Microsoft Entra
Node.js app, session, `.env.dev`	Authentication, MFA, consent
Terminal that keeps the server alive	App registration, enterprise application (service principal)
Browser	Token issuing

[!note] Local only Localhost means this computer. Nobody else can reach your copy by opening localhost on their PC.

Lab 1: Sync On-Premises AD to Entra ID

Sat, 03 Oct 2026 00:00:00 +0000

Lab 1: Sync On-Premises Active Directory to Microsoft Entra ID

[!abstract] Summary Goal: Install Microsoft Entra Connect Sync on a Windows Server VM and synchronize the users of the on-premises Active Directory forest (aden.local) to a Microsoft Entra ID tenant. Result: On-premises users appear in Entra ID with On-premises sync enabled = Yes, and password hash synchronization is enabled. Scope: This page covers the Entra Connect part (download, install, configure, verify). The Windows Server VM and the AD forest were built beforehand.