Auditing Windows, Active Directory, Entra ID and Azure Cloud
This 3‑day course provides a comprehensive approach to auditing Windows, Active Directory, Entra ID, Azure, and Microsoft 365 environments. As organizations move toward hybrid and cloud identity, auditors must understand how on‑premises Windows and AD interact with Entra ID, Azure resources, and M365 services — and how risks propagate across the entire ecosystem.
Participants learn how identity, access, configuration, and logging work across Windows, AD, Entra ID, Azure, and Microsoft 365, and how to evaluate the controls that secure each layer. The course covers the core risks in traditional Windows and Active Directory environments, the expanding attack surface introduced by cloud identity and Azure services, and the controls required to secure modern Microsoft deployments.
Hands‑on exercises give students the opportunity to audit their own Windows system, review Active Directory configurations, analyze Entra ID and Azure permissions, inspect logging and monitoring, and collect real audit evidence using PowerShell and other Microsoft tools. By the end of the course, participants will be able to perform a complete audit of a hybrid Microsoft environment and clearly communicate risks and remediation strategies.
CPE:
21
Program Level:
Intermediate
Delivery Method:
Live
Cost :
$990 for this live 3 day course
Course Contents/Objectives
I. Foundations of Microsoft Ecosystems
• How Windows, AD, Entra ID, and Azure fit together
• Identity as the security perimeter
• Hybrid identity patterns (on‑prem + cloud)
• Zero Trust principles for auditors
• Key risks in Microsoft environments
II. Windows Operating System Fundamentals
• Identifying Windows systems
• Registry & audit‑relevant keys
• Local resources & system components
• Windows command line & PowerShell basics
• Windows security features – UAC, MIC, Defender, SmartScreen
• Default services, ports, and applications
• Patch management & servicing channels
• Malware protection & endpoint hardening
III. Active Directory (On‑Prem Identity)
• LDAP fundamentals
• Domain Controllers & Global Catalog
• Forests, trees, trusts
• DNS
• OUs, Group Policy, delegation
• FSMO roles
• Server roles & AD DS architecture
• Common AD misconfigurations
• Evidence collection from AD – PowerShell, WMIC, event logs
IV. Entra ID (Cloud Identity)
• Entra ID vs. Active Directory
• Tenants, directories, domains
• Users, groups, roles
• Conditional Access
• MFA, passwordless, passkeys, FIDO2
• App registrations & enterprise applications
• Service principals & managed identities
• Privileged Identity Management (PIM)
• Audit logs & sign‑in logs
• Graph API for auditors
V. Hybrid Identity
• AD Connect – PHS, PTA, federation
• Sync rules & identity lifecycle
• Common hybrid identity failures
• Evidence collection for hybrid identity
• Security considerations for ADFS, PTA, PHS
VI. Azure Architecture & Resource Model
• Subscriptions
• Management Groups
• Resource Groups
• Azure Resource Manager (ARM)
• Regions, availability zones, paired regions
• Azure Landing Zones (CAF)
• Resource hierarchy & governance boundaries
VII. Azure Access & Permissions
• RBAC
• Role assignments & inheritance
• Managed identities
• Service principals
• Key Vault access control
• Privileged access patterns
• Auditor‑focused RBAC evidence collection
VIII. Azure Networking
• VNets, subnets, IP addressing
• NSGs & ASGs
• Azure Firewall
• Private endpoints
• VPN Gateway & ExpressRoute
• Bastion
• Common network misconfigurations
• How to audit network exposure
IX. Azure Compute & Containers
• Virtual Machines
• VM Scale Sets
• Availability Sets
• Extensions
• AKS -Kubernetes
• Container Instances
X. Azure Storage & Data Protection
• Storage accounts
• Blob, File, Queue, Table
• Encryption – at rest, in transit
• SAS tokens
• Replication – LRS/ZRS/GRS
• Backup & Site Recovery
• Data lifecycle & retention
XI. Azure Security Services
• Microsoft Defender for Cloud
• Secure Score
• Azure Security Benchmark
• Defender for Identity
• Defender for Endpoint
• Defender for Cloud Apps
• Key Vault
• Azure Policy & initiatives
• Resource locks
XII. Azure Monitoring & Logging
• Azure Monitor
• Log Analytics
• Activity Logs
• Resource Logs
• Alerts
• Workbooks
• KQL for auditors
• Sentinel – SIEM
• Evidence collection from Azure logging
XIII. Microsoft 365 Security & Compliance
• OneDrive
• SharePoint Online
• Exchange Online
• Teams governance
• Intune – device compliance, configuration profiles
• Purview – DLP, data governance, eDiscovery
• M365 Secure Score
• M365 audit logs
• Common M365 misconfigurations
XIV. Users, Groups & Access Control
• Local vs. domain vs. cloud users
• Default & common accounts
• Privileges & rights
• Permissions & access control models
• Administrator account recommendations
• Access review procedures
XV. Passwords & Authentication
• Password policies
• Credential hygiene
• Kerberos & NTLM
• Passwordless authentication
• Cloud authentication flows
XVI. Auditing & Logging Across the Ecosystem
• Windows logs
• AD logs
• Entra ID logs
• Azure logs
• M365 logs
• Correlating identity, access, and resource events
• Building defensible audit evidence
Laptop Required
Students are required to have a laptop in order to complete the hands-on exercises. The laptop should meet the following specifications for the student to get the most from the exercises:
• USB Port (in person classes)
• 8 GB RAM or higher
• 25 GB available hard drive space
• Windows 11 professional or later (Home or similar editions will not have some of the features needed.)
• Administrator privileges including the capability to install and run tools, as well as disable anti-virus
• VMWare Workstation should be installed
Note: Students will also have the option to follow along through full demonstrations of every lab. Those who prefer to watch rather than perform the hands‑on exercises can do so without missing any content.
Target Audience
• Internal Auditors
• IT Specialist Auditors
• IT Auditors
• IT Audit Managers
• Information System Auditors
• Information Technology Auditors
• Information Security Officers
Prerequisites
Participants should be familiar with Internet technologies and commonly used Internet security controls. No other advance preparation is required.
What People Say About Us
We help you see the world differently, discover opportunities you may never have imagined and achieve results that bridge what is with what can be.
Kendall
Ashley
Joel