Baseline Validation and Access Change Analysis (Graph API + RBAC Interpretation) In this lab, I focused on validating identity state within Microsoft Entra ID using Microsoft Graph and comparing it against a previously established identity snapshot derived from audit log analysis (Lab 05). The objective was to bridge event-based identity analysis with state-based identity validation, … Read more

1. Objective This lab extends Entra ID identity analysis into identity drift and access evolution modelling using audit log telemetry. The objective is to reconstruct how identity state changes over time through: Unlike a static IAM snapshot, this analysis treats identity as an event-driven system rather than a fixed configuration. 2. Evidence Sources and Analysis … Read more

1. Objective This lab demonstrates an end-to-end identity lifecycle within Microsoft Entra ID, focusing on identity provisioning, group-based access control (RBAC), and authentication validation using exported audit and sign-in telemetry. The objective is to analyse identity behaviour using structured, evidence-based interpretation of Entra ID logs, focusing on how identity creation, access modification, and authentication events … Read more

Objective This laboratory exercise explores identity-related system behaviour on a Windows 11 endpoint through analysis of authentication, session, and privilege-related telemetry. The purpose is to understand how normal identity activity is represented in system logs before attempting to identify anomalous behaviour. The focus is on building baseline understanding of authentication patterns, privilege assignment behaviour, and … Read more

This post documents the evolution of my lab environment into a lightweight, reproducible setup designed to support cloud and identity security learning. The focus is on building a stable environment that supports structured investigation of authentication behaviour, access control concepts, and cloud-based identity systems, particularly within Microsoft Azure and Entra ID contexts. The goal is … Read more

Introduction This Toshiba Satellite L500-13W was abandoned with Windows 7 and a failing Kali Linux installation. Overheating, keyboard misconfiguration, and disk errors made it unsuitable for learning. By stabilising the hardware and installing MX Linux, I turned it into a reliable, quiet lab device, suitable for building structured security labs and developing foundational cloud and … Read more