What problem does it solve? New security administrators often misconfigure Conditional Access policies and lock themselves out of their own tenant, or lack a structured way to learn identity hardening. This Skill guides learners through building a safe, report-only MFA enforcement policy for admin roles in Microsoft Entra, then teaches them to hunt for risky sign-ins using KQL. ## Core Features & Use Cases - Break-glass account setup: Create an emergency Global Administrator account excluded from all Conditional Access policies before any policy work begins. - Named locations and CA policy creation: Configure trusted IP named locations and a Report-only policy requiring MFA for directory roles like Global Administrator. - What-If validation and KQL hunting: Simulate sign-ins with the What-If tool and run four ready-made KQL queries against SigninLogs to detect failed MFA, impossible travel, risky sign-ins, and brute force. - Use Case: A cybersecurity student with an Entra P1 trial tenant follows the five phases to deploy their first Conditional Access policy safely, then uses the KQL queries to investigate authentication anomalies like a junior SOC analyst. ## Quick Start Ask the mentor to walk you through the cso-entra-identity-hardening project to create a named location and an MFA Conditional Access policy in your Entra tenant.
