# SC-300 - Lab 6 -10

visit [microsoft learn github](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Users/appId/8a4ff89a-5105-446c-8a2b-e24799cc34cc/objectId/47dca9c4-5216-4d51-8577-9c49c1e32703) for complete instructions

# Lab 06: Add a federated identity provider

## Lab scenario

Your company works with many vendors and, on occasion, you need to add some vendor accounts to your directory as a guest and allow them to use their Google account to sign-in.

### Exercise 1 - Configure identity providers

#### Task 1 - Configure Google to be used as an identity provider

1. Go to the Google APIs at [https://console.developers.google.com](https://console.developers.google.com), and sign in with your Google account. We recommend that you use a shared team Google account.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743115799530/055d6799-ff94-4ef7-be85-a105182f2837.png align="center")

2- Click on select a project and then create a new project

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743116043568/2a33ba48-710e-4700-858b-d2d691ed085a.png align="center")

3. Select the project and on the left menu select OAuth consent screen
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743176658399/842e14af-5a08-430b-a5a0-07736977823e.png align="center")

4. Click **“Get Started”**, select the app name **Entra ID**, and sign in with your **Gmail account**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743176723682/75ac4908-355f-44df-82c7-bc4f5b99db9a.png align="center")

5. For the **Audience**, choose **External**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743176895503/3c4a1b90-1a83-4b92-a6bb-83bd2cb27ef1.png align="center")

6. Contact information:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743177041448/e6a56d6b-bbde-4d5d-8ee1-1fec202a3c18.png align="center")

7. I agree to.. :
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743177341328/a953f621-d00b-450b-91c6-8696afb002ae.png align="center")

8. Click continue and create:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743177414834/b4e41344-3d7f-4d00-a477-31f56b0823c5.png align="center")

9. Click on create OAuth client and for application type select web application, name: Entra B2B, under authorized redirect URIs select the following URIs:
    

> [https://login.microsoftonline.com](https://login.microsoftonline.com)
> 
> [https://login.microsoftonline.com/te/\*\*tenant](https://login.microsoftonline.com/te/**tenant) ID\*\*/oauth2/authresp
> 
> (where <tenant ID> is your tenant ID)
> 
> * To find your tenant id and tenant (directory)name:
>     
> * Entra>**“Identity”** > **“Overview”** (under *Tenant*).
>     
> * Azure >the top-right corner> account name > **“Switch directory”** (if needed)>Click on your directory> Under **Overview**
>     
> 
> [https://login.microsoftonline.com/te/\*\*tenant](https://login.microsoftonline.com/te/**tenant) name\*\*.[onmicrosoft.com/oauth2/authresp](http://onmicrosoft.com/oauth2/authresp)
> 
> (where <tenant name> is your tenant name)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743179723016/98b785e6-d6bb-4b40-b12d-7a2df83f1e54.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743179751980/71f8729c-5514-4130-bb21-2e4d18597f95.png align="center")

10. Select **Create**. Copy your **client ID** and **client secret**. You'll use them when you add the identity provider in the Azure portal. You can leave your project at a publishing status of Testing
    

#### Task 2 - Add a test user

1. On https:// console.cloud.google.com go to **APIs & Services** > **OAuth consent screen**, then select Audience and add users under test ussers:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743180307990/922cae2f-53e5-41bd-bbda-b3fde362702d.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743180945685/1740e7fa-1d1b-40ba-9be5-afeda4861179.png align="center")

2. Enter your gmail and click on save
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743181026810/c3cf9acb-8b66-49d5-8b88-a38d119be301.png align="center")

### Exercise 2 - Configure Azure to work with an External identity provider

#### Task 1 - Configure Microsoft Entra ID for Google federation

1. Select **Microsoft Entra ID** > **Identity** > **External Identities** > **All identity providers** > **Google** > **Configure**
    
    (Microsoft provides a direct federation for **Google** as an identity provider)
    
2. Enter the client ID and Client secret that we optained (or you can find it in console.cloud.google.com > > API and Services > credentials )
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743181789707/00ba73e4-2db8-4abc-84d0-7526a770ab90.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743182068886/0100822b-a644-47ec-8de7-ffc1a9656fe3.png align="center")

#### Task 2 - Invite you Test User account

1. If you used an existing Gmail account, remember to delete the account with **External Identities | All identity providers**. You can also return to the Google developer console and delete the project that you created.
    
2. **Entra** > **All users** > **Invite External user** and enter your test gmail information
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743182890576/f8b0fb92-1e74-4d9c-8e7b-c2513a55dcdf.png align="center")

#### Task 3 - Accept the invitation and login

1. check your email and accept the invite and follow the prompts untill you gets to myapplications.microsoft.com
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183254563/6cb193ff-c84b-49f1-97ec-5b43d8482d66.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183307355/39e2dc5a-ff29-482b-bd56-6cb379b7e0ea.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183320961/7fd916c3-39ce-4dec-9dff-219172bea4df.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183372610/4e85c48d-c4ca-44b7-a0a2-a8ce2700e2d6.png align="center")

#### Task 4 - Login to Microsoft 365 using your Google account

1. Login to login.microsoft.com using your gmail account(choose sigin in option and then choose sign in to an organization)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183768209/65639350-5b6c-4f9d-b56f-0b742b72a6e8.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183820834/4ef830b7-b2f0-4101-b17a-c9788046febd.png align="center")

2. enter yout lab tenant domain name
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183930247/ef5a3211-e5e4-4c5c-b890-71c69b7e61ae.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183960139/76f63300-cb89-4677-90bf-e7fcf0c58935.png align="center")

3. and then it takes you to google login page:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743184030676/afa82dd3-ed04-423c-8f78-bae921fd7483.png align="center")

3. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743183996091/6bebdb1a-a928-489f-8d45-8d986b99d2d7.png align="center")
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743184075084/e46384f0-f377-4e70-8e07-c462ad9e55ce.png align="center")

---

## Lab 07: Add Hybrid Identity with Microsoft Entra Connect (Optional)

---

## Lab 08: Enable multi-factor authentication

Login type = Microsoft 365 admin

A Microsoft Entra ID Premium license is required for this exercise.

1. Login to entra and search for multifactor authentication (or just go to identity> protection> risky activity > multifactor authentication)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743195317028/92383635-869b-47cd-9a71-826311f7c0f3.png align="center")

2. Under configure click on additional cloud-based multifactor authentication settings
    

![Screenshot showing MFA options in the dashboard](https://raw.githubusercontent.com/MicrosoftLearning/SC-300-Identity-and-Access-Administrator/refs/heads/CloudSlice-and-M36tenant/Instructions/Labs/media/lp2-mod1-set-additional-mfa-settings.png align="left")

3. You can enable/ disable or enforce MFA from here:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743195800326/75144173-ce6c-42b3-848f-c79734d09ee4.png align="center")

4. In service settings : You can also enable or disable app passwords here, which allow users to create unique account passwords for apps that don't support multi-factor authentication. This feature lets the user authenticate with their Microsoft Entra identity using a different password specific to that app.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743196131802/492ab9ad-41db-4be1-8992-d558615ed8ba.png align="center")

#### Task 2 - Setup conditional access rules for MFA for Delia Dennis

1. Go to Entra > Identity> Protection > Conditional Access and for the policy name: MFA\_for\_username and then select the user:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743200871874/207eb5aa-f8c0-4053-9715-3ff65b32a814.png align="center")

2. For target resource select office 365 (previously we gave her o365 license)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743201917960/893f96ce-5a04-4677-9683-e24227f9e90c.png align="center")

3. For network select no for configure
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743202160267/0af12942-84ba-41df-b493-aa6779b0fabe.png align="center")

4. Also any network or location configured for condition:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743202372693/a6b7ccb4-81df-48cf-8bab-f5cb3e5fe990.png align="center")

5. Under grant do these settings and enable the policy and click on create:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743202555523/10cd5f28-aa4f-434f-82ac-6182032a69fc.png align="center")

#### Task 3 - Test Delia's login

1. login on www.office.com using Delia’s credential. You can see you need to have MFA.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743202824220/c9942085-21e9-43e5-9bc9-a61b5261ce1a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743202844723/f6ea4c6a-b972-4028-a01f-eae7d49c88ca.png align="center")

### Exercise 2 - Configure MFA to be required for login

#### Task 1 - Configure Microsoft Entra Per-User MFA

1. click on per user MFA
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743203619896/2e7ba38a-69f0-4eaf-aaf8-6ece93fb6a20.png align="center")

2. select the user and enable the MFA for the user and then try to login with the user:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743203758323/381ca560-8b50-4dbd-9b71-fabfe225c014.png align="center")

3. When you want to login you will be asked to use microsoft authenticator:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743204120204/f93157fb-3e2f-42be-8409-2ebfa06b4296.png align="center")

---

# Lab 09 - Configure and deploy self-service password reset

1. Create a security group of 3 users:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743534114074/ffc55e1f-4040-408f-9cd1-8e7b67f6b4a7.png align="center")

2. Enable SSPR for your test group (add the group on entra>protection>password reset>properties):
    
3. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743535029709/8059f600-fff4-48be-befe-502374f0b42c.png align="center")
    
    Under \**Manage*, select and review the default values for each of the **Authentication methods**, **Registration**, **Notifications**, and **Customization** settings.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743535252602/02a8a0c4-94ac-48b6-8157-e580deef7c75.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743535737893/21e90d5e-a98b-4a6b-8963-78392477dec5.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743536193901/341b9541-f081-425d-9e0a-3fa363b434b4.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743536217113/d46d36c3-9a9b-486c-87ba-f81a0636f5ef.png align="center")

3. Register a user in our test group for SSPR ( just login with the user on [https://login.microsoftonline.com/](https://login.microsoftonline.com/) ) and you will get this prompt:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537382049/b4c07015-a9aa-4628-86d0-499c7538f86e.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537404190/1836cab0-41de-4ee6-9682-23b259d8be9a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537441436/57f3258a-11a6-48b1-afdc-2fbcb73acd4b.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537469966/6905aeb1-cebe-4d78-b1a9-eb694ea37fca.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537483737/260cb19d-8f25-4bf0-b45a-cd1a2bb493af.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743537496075/22494193-bded-49d5-8a3c-8244ffebaa07.png align="center")

4. To test SSPR Use one of the users in your test group and in login screen of http://portal.azure.com click on forgot my password :
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538133946/180d2fca-4481-417e-a825-77f6e6e8de75.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538141835/ef871f39-02aa-408e-bd81-cf284f4f931b.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538271112/29478737-0a63-4660-9faa-bc7d1035d451.png align="center")

5. Use a user account that you previously configured with Multi-Factor Authentication (MFA) during Step 3 when signing in and click on forgot my password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538651108/9f4734f3-9460-435a-8b0c-5a2f0426cf09.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538693308/1c592811-04a3-4255-8ca5-65ea51e4b25b.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538748170/ccd7e5c1-2640-40ef-ba7e-e856f6587552.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538792892/9dae51b2-4fc7-4b3d-b750-ea6b89ea05fe.png align="center")

6. If you attempt to log in with a user who is not part of the SSPRTesters group and click ‘Forgot my password,’ you’ll see the following prompt:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743538934235/3115e775-5810-4bf2-9ba1-8d8a293dcbb7.png align="center")

---

# Lab 10 - Microsoft Entra Authentication for Windows and Linux Virtual Machines

### Login type = Azure Resource login

1. Create a vm and on the management tab select login with Microsoft Entra ID (On the **Management** tab, check the box to **Login with Microsoft Entra ID** under the Microsoft Entra ID section.)
    
    > You will notice that the System-assigned managed identity in the Identity section is automatically selected and grayed out. This behavior occurs by default when ‘Login with Microsoft Entra ID’ is enabled.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743618568832/0fd45fc4-68e0-44ca-8d48-ac0846880ae5.png align="center")

2. Assign a job function role of “**virtual machine administrator login**” to a user
    
3. Start an RDP session with the user to the virtual machine. Then, go to the Remote settings and uncheck “**Allow connections only from computers running Remote Desktop with Network Level Authentication**”.
    
4. Modify your RDP file to support the Microsoft Entra ID login:  Select the Connect menu item. On the RDP tab select the Download RDP File.
    
5. **Make a copy** of the RDP file and add **\-EntraID** to the end of the filename.
    
6. Edit the new version of the RDP file you just copied using **Notepad**. Add the these two lines of text to the bottom of the of the file:
    

> enablecredsspsupport:i:0
> 
> authentication level:i:2

7. **Save** the RDP file. You should now have two versions of the file:
    
    * <>.RDP
        
    * <>-EntraID.RDP
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1743620867108/8b7c79ed-a4f4-4edd-8e37-6adea774f58a.png align="center")

8. Run the rdp-entraid and login with entra id user with vm admin login access(try with any other user and you cannot login)