Continue your lesson
Trace the identity, credential, token, assignment, policy decision, resource, and audit record for each access request.
Block 1 of 5Compare FIDO2 security key or passkey · Windows Hello for Business
Current · 12 min
Compare FIDO2 security key or passkey · Windows Hello for Business
Optional concept notes
FIDO2 security key or passkey
Provides phishing-resistant passwordless authentication through public-key credentials.
Windows Hello for Business
Uses a device-bound key and gesture for strong user authentication.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 2 of 5Compare Microsoft Authenticator passwordless sign-in · Self-service password reset · Microsoft Entra Password Protection
18 min
Compare Microsoft Authenticator passwordless sign-in · Self-service password reset · Microsoft Entra Password Protection
Optional concept notes
Self-service password reset
Lets eligible users reset or unlock their account after completing configured verification.
Microsoft Entra Password Protection
Blocks weak or banned password terms in cloud and supported hybrid password changes.
Microsoft Authenticator passwordless sign-in
Uses a registered mobile authenticator and number matching instead of a password.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 3 of 5Compare Microsoft Entra Kerberos · Tenant-wide MFA configuration
15 min
Compare Microsoft Entra Kerberos · Tenant-wide MFA configuration
Optional concept notes
Microsoft Entra Kerberos
Supports Kerberos authentication for selected hybrid resources with Microsoft Entra identities.
Tenant-wide MFA configuration
Establishes supported multifactor registration and enforcement settings across the tenant.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 4 of 5Compare Authentication methods policy · Temporary Access Pass · Certificate-based authentication · Authentication strength
18 min
Compare Authentication methods policy · Temporary Access Pass · Certificate-based authentication · Authentication strength
Optional concept notes
Authentication methods policy
Controls which modern authentication methods are available to selected Microsoft Entra users.
Temporary Access Pass
Provides a time-limited credential used to bootstrap passwordless registration or recovery.
Certificate-based authentication
Authenticates a user with a trusted X.509 certificate mapped to the identity.
Authentication strength
Defines which method combinations satisfy a Conditional Access authentication requirement.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Block 5 of 5Understand Revoke user sessions
8 min
Understand Revoke user sessions
Optional concept notes
Revoke user sessions
Invalidates refresh tokens so a disabled or at-risk user must authenticate again.
Complete one provider lesson, then answer four related questions. That is enough for today; more practice is optional.
Your lesson stays open here while the provider opens in another tab. Choose one source; the notes above are optional.
Practice the reasoning here
Use a fictional tenant. Draw one access path, apply least privilege, test an exception, and name the logs that would confirm the result.
- State the expected result before changing or testing anything.
- Name the observation, command, log, or report that would confirm it.
- Explain why the closest alternative does not fit the same requirement.
Check the whole objective
This unlocks objective 2.1 for recall. The latest checkpoint needs 70% or higher; a lower result puts the lesson back near the front of your timeline.