Week 6 Overview — Networking 7

E5 trial active Each student: isolated VM environment Entra ID Connect — install from scratch Full hybrid identity build

Day 1
Connect install + Hybrid join

Day 2
Compliance + CA device

Day 3
Config profiles + KFM + Updates

Day 4
App deploy + Linux MDM

Day 5
Assessment

Each student runs a fully isolated VM environment on their host machine — their own domain, their own devices, their own Intune tenant. They experience every part of the hybrid identity build as a sole admin, not a participant in a shared environment. This is the most operationally realistic week of the course.

Recommended VM environment per student

DC-01 Windows Server 2022
AD DS · DNS · DHCP
lakeviewlogistics.local

WIN-CLIENT-01 Windows 11 Pro
Domain-joined
Primary Intune endpoint

WIN-CLIENT-02 Windows 11 Pro
Domain-joined
Compliance test target

LINUX-01 Ubuntu 22.04 LTS
Not domain-joined
Intune agent enrolled

MEM-SRV-01 Windows Server 2022
Member server
Optional — app target

Minimum viable: DC-01 + WIN-CLIENT-01 + LINUX-01 covers all core steps. WIN-CLIENT-02 enables side-by-side compliant vs non-compliant testing on Day 2. MEM-SRV-01 is optional. Students should build as many VMs as their host can comfortably run — this environment becomes the platform for Weeks 6–8.

Daily breakdown

Day 1

Lecture: hybrid identity model, MDM vs MCM, Intune portal

Lab 6-A: Download + install Entra ID Connect on DC-01 → express config → verify sync → GPO auto-enrollment → hybrid join WIN-CLIENT-01 → verify in Intune + Entra ID + dsregcmd

Day 2

Lecture: compliance policy model, grace period, noncompliant actions

Lab 6-B: Windows compliance policy → device group → intentionally break WIN-CLIENT-02 → observe non-compliant → remediate → add compliant device condition to CA001

Day 3

Lecture: config profiles, settings catalog, update rings

Lab 6-C: KFM config profile (finally deploys Lab 4-D design) → Windows Update ring → Endpoint Security baseline → Settings Catalog custom policy → verify on WIN-CLIENT-01

Day 4

Lecture: Win32 packaging with IntuneWinAppUtil, Linux agent model

Lab 6-D: Package Win32 app → upload to Intune → deploy to WIN-CLIENT-01 → deploy Microsoft Store app → install Intune agent on LINUX-01 → enroll → Linux compliance policy → verify

Day 5

Review + tenant/VM tidy

Assessment: non-compliant device scenario — diagnose, fix, verify compliance state, explain the full CA → device compliance → M365 access chain in writing

Day 1 — Entra ID Connect install sequence (Lab 6-A is the largest lab of the course)

#	Phase	What happens	Location	~Time
1	Pre-flight check	Verify DC-01: AD DS running, DNS resolving internally and to internet, on-prem user accounts present, DC can reach microsoft.com. Run dcdiag /test:dns	DC-01	5 min
2	Download Connect	Download AzureADConnect.msi from microsoft.com/download on DC-01. Save to Desktop.	DC-01	5 min
3	Install Connect	Run installer as Domain Admin. Choose Express Settings. Sign in with M365 Global Admin. Sign in with on-prem Enterprise Admin. Review and confirm options. Install. Express settings automatically enables password hash sync, hybrid join, and device writeback.	DC-01	15 min
4	Verify initial sync	Connect triggers an initial sync after install. Open Synchronization Service Manager on DC-01 — confirm all export operations succeeded. Navigate to Entra ID portal → Users — confirm on-prem accounts appear with source = Windows Server AD.	DC-01 + Entra portal	8 min
5	Enable MDM auto-enrollment GPO	On DC-01, open GPMC. Create a new GPO: Intune Auto-Enrollment. Navigate to Computer Configuration → Policies → Administrative Templates → Windows Components → MDM → Enable automatic MDM enrollment using default Azure AD credentials. Set to Enabled. Select Credential Type = Device. Link GPO to the domain (or OU containing WIN-CLIENT-01).	DC-01 GPMC	8 min
6	Force sync cycle	On DC-01 in PowerShell: Import-Module ADSync then Start-ADSyncSyncCycle -PolicyType Delta. This syncs any computer objects and ensures hybrid join registration is configured in Entra ID.	DC-01 PowerShell	3 min
7	Run gpupdate on client	On WIN-CLIENT-01: gpupdate /force. This picks up the auto-enrollment GPO. MDM enrollment triggers in the background — may take 5–15 minutes. Meanwhile: dsregcmd /status to monitor join state.	WIN-CLIENT-01	10 min
8	Verify hybrid join	On WIN-CLIENT-01: dsregcmd /status. Look for: AzureAdJoined : YES and DomainJoined : YES simultaneously. This is the hybrid join confirmation. Also check: WorkplaceJoined : NO (workplace join is the old model — hybrid is different).	WIN-CLIENT-01	5 min
9	Verify in Intune portal	Navigate to intune.microsoft.com → Devices → All devices. WIN-CLIENT-01 should appear. Verify: Join type = Hybrid Azure AD joined, MDM = Microsoft Intune. Click the device — explore the hardware inventory, discovered apps, and compliance state (will show Not evaluated until a compliance policy is assigned).	Intune portal	8 min
10	Verify in Entra ID	Navigate to Entra ID → Devices → All devices. WIN-CLIENT-01 should appear with Registration type = Hybrid Azure AD joined and Join type = Hybrid Azure AD joined. The device object in Entra ID is what the CA policies evaluate for device compliance.	Entra portal	5 min

Week 6 connections to earlier labs — the payoffs

Week 6 topic	Connects to	The payoff
Entra ID Connect / hybrid identity	Week 1 user creation, Week 2 Entra ID identity	On-prem AD accounts (Sarah Chen, Priya Nair, etc.) now exist in Entra ID as synced identities. The same users students built in Week 1 sign into M365 from domain-joined machines as hybrid identities.
CA device compliance condition	Week 2 CA001–CA004 (Report-only → On)	The CA policies now get a device compliance gate. A user with valid MFA on a non-compliant device is blocked. The Week 2 work and the Week 6 compliance policy work together for the first time.
Known Folder Move deployment	Lab 4-D Bonus B — KFM design	Students designed the KFM Group Policy settings in Week 4. This week they implement it via Intune config profile — the same Desktop/Documents/Pictures folders now sync to the OneDrive configured in Week 4.
Linux Intune agent	Week 3 email policy, Week 5 Teams guest	The same M365 accounts and governance mindset now extends to Linux endpoints. A Ubuntu machine with the Intune agent enrolled is subject to the same compliance framework as Windows devices.
BitLocker compliance	Week 2 — identity hardening	The compliance policy requires BitLocker encryption. On a VM this is BitLocker on a virtual disk — the same concept, now enforced at the device level rather than just policy level.

Timing note for Day 1: Entra ID Connect installation + initial sync + hybrid join completion takes real time. The 10-step sequence above is 72 minutes of active work — it fills the full lab window. Students should have their VMs running and DC-01 pre-checked before the lab begins. The lecture is kept short (25 minutes) precisely to give the full remaining time to the lab. If a student's hybrid join doesn't complete in the session, Day 2 starts with a 10-minute catch-up before the compliance policy lecture.

This is the most technically ambitious lab of the course — installing and configuring enterprise identity infrastructure from scratch in a single session. Students who complete Lab 6-A successfully have performed a task that many junior IT admins have never done. Make that explicit in the debrief.

Start with Day 1 →Week 7 →