Continue your lesson
Trace the identity, credential, token, assignment, policy decision, resource, and audit record for each access request.
Block 1 of 3Compare Company branding · Custom domain name
Current · 12 min
Compare Company branding · Custom domain name
Optional concept notes
Custom domain name
Lets tenant identities use an organization's verified DNS domain instead of the initial tenant name.
Company branding
Customizes supported Microsoft Entra sign-in pages with organizational visual elements and text.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 2 of 3Compare Administrative unit · Microsoft Entra built-in role · Microsoft Entra custom role · Effective role permissions
18 min
Compare Administrative unit · Microsoft Entra built-in role · Microsoft Entra custom role · Effective role permissions
Optional concept notes
Administrative unit
Scopes selected directory administration to a defined set of users groups or devices.
Microsoft Entra built-in role
Grants a fixed Microsoft-defined set of directory permissions for a common administrative task.
Microsoft Entra custom role
Combines supported directory permissions into an organization-defined administrative role.
Effective role permissions
Show the combined directory permissions an administrator receives through current assignments.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 3 of 3Compare Tenant properties · Tenant user group and device settings
12 min
Compare Tenant properties · Tenant user group and device settings
Optional concept notes
Tenant properties
Store directory-wide details such as display name contacts and privacy statement links.
Tenant user group and device settings
Control directory-wide defaults and allowed behavior for users groups and devices.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Practice the reasoning here
Use a fictional tenant. Draw one access path, apply least privilege, test an exception, and name the logs that would confirm the result.
- State the expected result before changing or testing anything.
- Name the observation, command, log, or report that would confirm it.
- Explain why the closest alternative does not fit the same requirement.
Check the whole objective
This unlocks objective 1.1 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.