Week 2, Day 1 — Entra ID administrative roles & least privilege

Week 1 debrief & the security gap

Bridge from Week 1 into Week 2 by surfacing the most obvious security problem with the tenant as it currently stands.

• Return Week 1 assessments with brief verbal feedback — highlight one common strength and one common gap across the class
• Ask: "Right now, who in Lakeview Logistics has admin access to the M365 tenant?" — answer: only the Global Admin account, which every student has been using for everything all week
• Ask: "What happens to Lakeview Logistics if that Global Admin account is compromised?" — surface the single point of failure
• Frame the week: Week 2 is about removing that single point of failure — distributing admin access correctly, enforcing strong authentication, and controlling the conditions under which access is granted

Entra ID roles — the right access for the right person

Microsoft Entra ID has over 80 built-in administrative roles. Students don't need to memorise all of them — they need to understand the model, know the most important roles cold, and be able to reason about which role fits a given situation.

• The role-based access control (RBAC) model in Entra ID — roles are collections of permissions. Assigning a role to a user grants them those permissions within the scope defined. Roles are additive — a user can hold multiple roles simultaneously. No role means no admin access. The default state for a new user is correct: zero roles.
• The roles every M365 admin must know — cover these in detail:

• Global Admin: the break-glass account — the Global Admin account should be treated like a physical key to a locked server room. It exists for emergencies and major configuration tasks. It should have a very strong password, MFA enforced, and never be used as a daily sign-in. Best practice: create a named Global Admin account (e.g. admin-emergency@[subdomain]) separate from the admin's personal account, stored securely, used rarely.
• Role assignment scope — roles can be assigned at tenant scope (affects everything) or, with Entra ID P2, at administrative unit scope (affects only a subset of users/groups). Business Standard supports tenant-scope only. This will change when E5 is added.
• Custom roles — Entra ID P1/P2 supports custom roles built from individual permissions. Not available on Business Standard — but worth knowing exists for when it matters.

Lab 2-A: Assigning administrative roles to Lakeview Logistics staff

Students assign the correct Entra ID roles to the Lakeview Logistics team using three methods — the M365 admin centre, the Entra admin centre, and Microsoft Graph PowerShell. They then test role boundaries by signing in as a role-limited user and attempting actions outside their permissions.

• Step 1 — Assign roles via the M365 admin centre (15 min)
  Navigate to Users → Active users → [user] → Roles tab → Manage roles. Assign the following roles:

• Step 2 — Assign roles via the Entra admin centre (10 min)
  Navigate to entra.microsoft.com → Roles and administrators → [role name] → Add assignments. Assign Billing Administrator to Priya Nair and Global Reader to Marcus Webb. Note that the Entra admin centre shows the full role description and permissions list — explore this for both roles before assigning.
• Step 3 — Assign a role via PowerShell (15 min)
  Connect to Microsoft Graph:
  Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
  
  Get the role definition ID for User Administrator:
  $role = Get-MgDirectoryRole | Where-Object {$_.DisplayName -eq "User Administrator"}
  
  If the role is not yet activated in the tenant, activate it first:
  $roleTemplate = Get-MgDirectoryRoleTemplate | Where-Object {$_.DisplayName -eq "User Administrator"}
  New-MgDirectoryRole -RoleTemplateId $roleTemplate.Id
  
  Get Diane Rousseau's Object ID and assign the role:
  $user = Get-MgUser -Filter "displayName eq 'Diane Rousseau'"
  New-MgDirectoryRoleMember -DirectoryRoleId $role.Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$($user.Id)"
  
  Verify by checking Diane's Roles tab in the Entra admin centre.
• Step 4 — Test role boundaries (25 min)
  Open a private/incognito browser window and sign in as Dev Sharma (Helpdesk Administrator) at admin.microsoft.com.
  
  Attempt the following and record the result (allowed / blocked / partially allowed) in your Lab Journal:

• Step 5 — Audit role assignments via PowerShell (10 min)
  Back in your Global Admin session, run the following to produce a full report of all role assignments in the tenant:
  Get-MgDirectoryRole | ForEach-Object {
    $role = $_
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
    foreach ($m in $members) {
      [PSCustomObject]@{ Role=$role.DisplayName; Member=$m.AdditionalProperties.displayName }
    }
  } | Format-Table -AutoSize
  
  Copy the output into your Lab Journal. This is the kind of role audit report a security team would run regularly.

⭐ Bonus: Administrative units & custom role exploration

For students who complete the core lab early. Two independent extension tasks — attempt either or both.

Reflection & preview

• Ask: "Lakeview Logistics now has five people with admin roles. Is that more secure or less secure than before, when only the Global Admin account had access?" — surface the nuance: more accounts with limited roles is safer than one account with unlimited access
• Ask: "Sarah Chen has User Administrator. Can she change Marcus Webb's Global Reader role? Can she change her own role?" — test understanding of role boundaries at the admin tier
• Collect exit ticket: name the role you would assign to a new IT support hire who needs to reset user passwords but nothing else — and explain what would happen if you gave them User Administrator instead
• Preview Day 2: roles are assigned — but none of these admin accounts have MFA enforced yet. Tomorrow that changes for everyone.