S3. Hybrid identity and governance

Outcome: you can connect on-premises identity to the cloud and control access and cost there.

Skills: Microsoft Entra ID, hybrid identity sync, role-based access control, Azure Policy, management groups, resource locks, tagging, Azure Arc, Azure budgets.

Labs

1. Set up an Azure free account with a budget alert before anything else.
2. Add a custom domain to Entra ID. Add a matching UPN suffix on-premises (a subdomain of a domain you own works).
3. Sync a subset of users with Entra Connect.
4. Create groups, assign built-in and custom Azure roles, and test them with a restricted user.
5. Apply an Azure Policy that requires a tag. Prove it blocks a non-compliant resource.
6. Onboard SRV1 to Azure Arc.

Prove it: an access matrix showing who can do what and why, and screenshots of the policy denying a deployment.

Certs: AZ-104 (identity and governance, 20-25%), AZ-802 (hybrid management), Cloud+ (IAM concepts).