Lab: Entra identity and governance controls

Outcome

Use groups to manage a training user/guest and license entitlement, then apply RBAC, Policy, locks, tags, and budget alerts at the correct scope. Diagnose why each control does—or does not—change access or configuration.

Do

1. Create a training security group and a test user or authorized guest identity. Assign a suitable test license through the group only if your tenant provides one; otherwise document the portal steps without consuming a license.
2. Assign the group Reader at one training resource group. Verify that it can view but cannot create a resource.
3. Apply a tag/region Policy assignment at the training scope. Attempt a deliberately non-compliant training deployment and inspect the Policy result.
4. Add a CanNotDelete lock to one disposable resource. Attempt a delete using an authorized training account, then remove the lock and delete it.
5. Create a training budget/alert and use tags to make cost ownership visible.

Verify

Capture group membership/license result, effective RBAC assignment, Policy compliance result, lock behavior, tags, and budget alert. Explain the separate roles of Entra licensing, Azure RBAC, Policy, locks, and tags.

Break and fix

1. Add a narrower Reader assignment to an identity with a broader Contributor assignment. Show that RBAC remains additive; remove the broad assignment to actually restrict access.
2. Remove a required tag or choose a prohibited region in the training deployment. Explain the Policy denial, fix the configuration, and re-deploy.

Scenario practice

1. Configure: Choose the narrowest scope and control for a team that must read a resource group, enforce a required tag, and prevent accidental deletion.
2. Diagnose: A user with Reader cannot deploy, while a deployment is denied even for Contributor. Which evidence distinguishes RBAC from Policy?
3. Distinguish: Explain why a license, Azure RBAC assignment, Policy, lock, and budget alert solve different problems.

Clean up

Remove test guests/users/groups/licenses only if created exclusively for the exercise, then remove role assignments, policy assignments, locks, budgets, resources, and the training resource group.

Sources and re-audit

• Azure RBAC overview, Azure Policy overview, and resource locks, checked 2026-08-22.

Re-audit when Entra licensing, Azure RBAC scope behavior, Policy effects, lock behavior, or Cost Management budget controls change.

Related

license-management · rbac · azure-policy · resource-locks · azure-cost-management · All labs