---

MD-102 Hands-On Lab Tutorials

Microsoft Entra, Intune & Identity Management

---

🧪 Lab 1: Configure Conditional Access

Require MFA + Azure AD–Joined Device from Untrusted Locations

Lab Objective

Create a Conditional Access policy that:

• Targets Global Administrators
• Requires Multi-Factor Authentication
• Requires an Azure AD–joined device
• Applies only from untrusted locations

---

Prerequisites

• Access to Microsoft Entra
• Global Administrator role
• At least one test user (not your break-glass admin)
• One trusted location (for testing)

---

Step 1: Create a Named Location (Trusted)

1. Open Azure portal
2. Go to:
   Microsoft Entra ID → Protection → Conditional Access → Named locations
3. Select + Countries location or + IP ranges
4. Name: Trusted-Office
5. Save

📌 Everything outside this location is considered untrusted.

---

Step 2: Create the Conditional Access Policy

1. Go to:
   Microsoft Entra ID → Protection → Conditional Access
2. Select + New policy

---

Step 3: Configure Assignments

Users

• Select Directory roles
• Choose Global Administrator
• Exclude:
  • Emergency access account (recommended)

Cloud Apps

• Select Azure management
  (or “All cloud apps” if explicitly stated in the exam)

Conditions → Locations

• Include: Any location
• Exclude: Trusted-Office

---

Step 4: Configure Grant Controls (Critical Step)

1. Go to Access controls → Grant
2. Select:
   • ✅ Require multi-factor authentication
   • ✅ Require Azure AD joined device
3. Choose Require all selected controls
4. Click Save

---

Step 5: Enable the Policy

• Set Enable policy to On
• Save

---

Validation

• Sign in from:
  • Trusted location → policy should not apply
  • Untrusted location → MFA + Azure AD join required

---

Lab Outcome

✔ Correct enforcement using Grant controls
✔ Matches MD-102 exam logic exactly

---

🧪 Lab 2: Upgrade Windows 11 Pro to Enterprise Using Intune

Lab Objective

Upgrade Windows 11 Pro devices to Windows 11 Enterprise using Intune.

---

Prerequisites

• Windows 11 Pro device
• Device is Azure AD joined
• User has Enterprise license
• Device enrolled in Microsoft Intune

---

Step 1: Create Edition Upgrade Policy

1. Go to:
   Intune admin center → Devices → Windows → Configuration profiles
2. Select + Create profile
3. Platform: Windows 10 and later
4. Profile type: Edition upgrade and mode switch

---

Step 2: Configure Settings

• Edition to upgrade to: Windows 11 Enterprise
• Save

---

Step 3: Assign the Policy

• Assign to a test device group
• Save

---

Validation

On the device:

• Go to Settings → System → About
• Confirm edition = Windows 11 Enterprise

---

Exam Insight

Edition upgrades always use configuration profiles, never compliance or update rings.

---

🧪 Lab 3: Linux VM Deployment with Trusted Root CA (Cloud-Init)

Lab Objective

Deploy an Ubuntu VM and install a trusted root CA during provisioning.

---

Prerequisites

• Azure subscription
• Azure CLI installed
• Root CA certificate file (rootCA.crt)

---

Step 1: Create Cloud-Init File

Create a file named cloud-init.yml:

#cloud-config
ca-certs:
  trusted:
    - |
      -----BEGIN CERTIFICATE-----
      YOUR-CERTIFICATE-CONTENT
      -----END CERTIFICATE-----

---

Step 2: Deploy VM Using Azure CLI

az vm create \
  --resource-group MyRG \
  --name UbuntuVM \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --custom-data cloud-init.yml \
  --generate-ssh-keys

---

Validation

• SSH into VM
• Verify certificate is installed:

ls /etc/ssl/certs

---

Exam Insight

Linux customization during deployment = Azure CLI + cloud-init

---

🧪 Lab 4: Azure AD Connect – Immediate Sync

Lab Objective

Force immediate synchronization of a new on-prem user to Entra ID.

---

Prerequisites

• Azure AD Connect installed
• Access to sync server

---

Step 1: Create On-Prem User

Create a new user in Active Directory.

---

Step 2: Run Delta Sync

On the Azure AD Connect server:

Start-ADSyncSyncCycle -PolicyType Delta

---

Validation

• Go to Microsoft Entra ID → Users
• Confirm user appears within minutes

---

Exam Trap

❌ Initial sync = slower full sync
❌ AD Sites & Services replication ≠ Entra sync

---

🧪 Lab 5: Review Device Audit Logs

Lab Objective

View device-related audit activity in Entra ID.

---

Steps

1. Go to:
   Microsoft Entra ID → Devices → Audit logs
2. Filter by:
   • Activity: Add device
   • Initiated by: User or system
3. Export logs (optional)

---

Exam Insight

Audit logs show what happened. Conditional Access decides what is allowed.

---

🎯 Final Lab-to-Exam Mapping

Exam Topic	Lab
Conditional Access MFA + Device	Lab 1
Windows Edition Upgrade	Lab 2
Linux VM customization	Lab 3
Azure AD Connect sync	Lab 4
Device auditing	Lab 5

---