Read this first — two systems, one door
Microsoft Entra and Azure are separate permission systems. An Entra role grants you nothing over Azure resources. An Azure role grants you nothing in Entra. People assume otherwise constantly, and the assumption is usually harmless — right up until it isn't.
There is exactly one door between them: Entra ID → Properties → Access management for Azure resources. A Global Administrator sets it to Yes and is assigned User Access Administrator at root scope, which means every subscription and every management group in the tenant. It is self-service, it is per-user, and it does not switch itself back off.
- Audit before you change anything. Every control here has a "who's using this today" query. That query is the difference between a change and an outage.
- One setting at a time. There is no report-only mode for tenant settings. Flip six at once and you won't know which one broke things.
- Tell the helpdesk first. What breaks here shows up as a confused user, not an error message.
- Elevated access is for a task, not a posture. On for the job, off afterwards. That applies to your work in this dojo too.
- Entra reverts in seconds. Azure often doesn't. A deleted role assignment has to be rebuilt by hand. A transferred subscription can't simply come home.
Full guidance: Secure your Microsoft Entra identity infrastructure ↗
Size up your environment
Three questions. The Azure answer matters most — say no and ten controls disappear rather than scoring against subscriptions you don't own. If you've been through another dojo, your licence is already filled in.
Do you run Azure subscriptions?
"Not sure" counts as yes, deliberately. A subscription you've forgotten about is worse than one you're managing — and this dojo will help you find it.
Do you collaborate with external organisations?
Is paid Defender CSPM enabled for resources in scope?
Walk out with a plan
Your plan reflects recorded answers and progress, including unresolved and deferred controls. Configuration examples require review of permissions, licensing, dependencies and placeholders. PowerShell bundles include an execution stop; read and edit them before deliberately running a selected section.