Hands-on lab2025–2026
Modern Workplace Lab: Entra ID, Intune, Conditional Access and identity lifecycle
One connected Microsoft 365 environment, built like a mid-market project: an employee is created with Graph PowerShell, gets a managed device, reaches company data only with MFA and a compliant device, and is cleanly removed on leaving. Documented with scripts, screenshots and the pitfalls I hit along the way.
- Joiner, mover, leaver with the Microsoft Graph PowerShell SDK: eight scripts
- Windows 11 via Entra join with automatic Intune enrollment, MacBook via Company Portal
- Compliance policies for Windows and macOS, Conditional Access requiring MFA and a compliant device
- Android Enterprise: dedicated device via QR code, apps from Managed Google Play, remote actions
One example of the kind of detail you only learn by typing it yourself: disabling an account fails with “positional parameter cannot be found”, because the Graph SDK expects the change as a body object.
# fails
Update-MgUser -UserId $id -AccountEnabled $false
# correct
Update-MgUser -UserId $id -BodyParameter @{ AccountEnabled = $false }