Jensen IT Notes
Back to projects

Documented lab

Microsoft 365 Admin Lab

I use a test tenant to work through account and access tasks that are difficult to reproduce in a local homelab.

Overview

Why I built it

Use a test tenant to document user lifecycle and access-control tasks that cannot be reproduced in a local Windows lab.

Lab environment

The lab uses Microsoft 365 Admin Center, Microsoft Entra admin center, test users, Entra ID P1 features, and written user-side verification steps.

What I configured

User onboarding and licensing, group membership, Temporary Access Pass, Microsoft Authenticator, offboarding, MFA with Conditional Access, suspicious sign-in response, device compliance concepts, and Teams and SharePoint access.

Topology and workflow

How the work is organized

  1. 1 Create test users and assign the required licence and group membership
  2. 2 Set up Temporary Access Pass and Microsoft Authenticator
  3. 3 Apply Conditional Access to a test user with the admin account excluded
  4. 4 Verify onboarding, MFA, blocked access, offboarding, and session revocation from the user side

Troubleshooting

Problem encountered

Conditional Access can affect the wrong account or appear not to work when assignments, exclusions, licensing, or device state are wrong. Testing only from the admin page does not prove the user flow works.

Checks, findings and fixes

MFA policy verification

Problem
The lab needed to require MFA for one test user without placing the administrator account inside the first test.
Check
Review the policy assignments, target resources, grant control, exclusions, and policy state.
Finding
The test user was included, the administrator was excluded, all resources were targeted, and Require multifactor authentication was selected.
Fix
Enable the completed Conditional Access policy for the selected test user.
Verification
The user-side Office sign-in required Microsoft Authenticator before access was granted.

Resolution

I used test users, reviewed policy targets and exclusions, then verified MFA and blocked-access results from the sign-in side. The suspicious sign-in lab also included password reset and session revocation.

Verification

  • The onboarding test user completed Authenticator registration
  • The selected test user received an MFA prompt before access
  • The offboarded test user could no longer sign in
  • The suspicious sign-in response included a password reset and session revocation

What I learned

An admin change is not finished until the intended user can sign in, use the assigned service, or receive the expected block.

GitHub repository

The repository contains the complete lab documentation, configuration notes, verification steps, and original screenshots.

View the complete lab and screenshots on GitHub