DEV Community: Rahimah Sulayman

Strengthening Identity Security with Conditional Access Policies in Microsoft Entra ID

Rahimah Sulayman — Thu, 09 Jul 2026 14:49:43 +0000

Introduction

As organizations embrace cloud-first environments, protecting user identities requires more than just strong passwords. Conditional Access in Microsoft Entra ID enables administrators to make intelligent access decisions based on user identity, device compliance, location, application, and risk, ensuring that only trusted users can access organizational resources under the right conditions.

In this hands-on guide, I'll walk through creating and configuring a Conditional Access policy, targeting specific users and cloud applications, enforcing access controls, and using the What If tool to validate policy behavior before deployment. These practical exercises demonstrate how Conditional Access helps organizations implement Zero Trust principles while minimizing the risk of misconfigured security policies.

Exercise - Perform basic Conditional Access policy tasks

In this exercise you will learn to create and configure a Conditional Access policy and test its results with the What If analysis tool.

This exercise should take approximately 10 minutes to complete.

Task 1 - Review a Conditional Access policy

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select Conditional access submenu.

4.Review the information provided on the Conditional Access Overview page.

Note - You can see how many policies you have enabled, and how many users who have logged in recently that are not covered by a policy, along with other details(if you created any).
5.Select the + Create new policy from the top menu.

6.In the Name box enter Block Bhogeswar from using Sway.

7.In the Assignments section select 0 users and agents selected text.

In the Include section mark the Select users and groups item.
Put a mark in the Users and groups box.

When the list of users and groups opens, select Bhogeswar Kalita from the list.
Use the Select button to add the user.

Select the word Exclude to switch tabs.
Put a mark in the Users and groups box.
When the list of users and groups opens, select the admin user you are using from the list.
Use the Select button to exclude this user.

Lab tip - We have added a user for this policy and we have added an exclude for our admin, to make sure they are not accidentally locked out by a policy change.

8.Find the section Target resources section.

9.Select the No target resources selected text from this section.

Make sure Resources (formerly cloud apps) is chosen in the dropdown.
Put a mark in the Select resources item.
In the section titled Select choose the word None.
When the resource selection dialog opens, enter Sway into the search bar.
Put a check in the box next to Sway then use the Select button to approve the choice.

Lab tip - We have chosen the app Sway to be the resource this policy works on. You could choose multiple apps, or you could even choose to exclude apps.

Notice the name and target resource.

10.Open and review the Network section, but we are not going to use that for this lab.

11.Open and review the Conditions section, but we are not using it for this lab.

Lab tip - Network and Conditions are powerful options in the Conditional Access policy, but they are not required for this simple policy to block access to an app. You would use them if you wanted to do things like restrict access for user working from a specific location, or block access if a user has shown risky behavior. There are many granular options that you can choose from, or even combine together.

12.Find the section titled Access controls.
13.Under the word Grant select the text 0 controls selected.
14.When the Grant dialog opens, select the Block access item.

15.Use the Select button to accept the change.

Lab tip - You have not set the values needed to create a simple block access policy to the Sway app for Bhogeswar. In the Access controls section, we could have allowed access with specific conditions like MFA or a domain joined device.
16.At the bottom of the Conditional Access interface, find the Enable policy item.
17.Set the value to On.

18.Select the Create button.

Lab tip - You have three options to pick from, and you can change value at any time, without having to change the policy.

On = enables the policy to run
Off = turn the policy off in case you need to modify it.
Report-only = use this option to review the outcome of the policy before you fully turn it on.

Task 2 - Perform a What If analysis for a conditional access policy

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select Conditional access submenu.
4.From the Conditional access screen select the What if option from the top menu.

5.In the section User or Workload identity select the text No user or service principal selected.
6.Make sure the box next to User is marked.
7.Select the text No user selected or Edit user.
8.From the Users list, put a mark next to Bhogeswar Kalita, then use the Select button.

9.In the Cloud apps, actions, or authentication context, select the text Any cloud app.
10.When the Select target type dialog opens, confirm that Cloud apps is chosen in the dropdown.
11.Click on the + Select cloud app.
12.Use the search to find the Sway app, then use the Select botton to finalize.

13.Scroll down to the bottom of the What If tool.

14.Select the button What If.

Note - the results appear off the bottom of the screen, so you will need to scroll down again.
15.You should see the Block Bhogeswar from using Sway policy listed, and it is blocking access.

16.You have to make selections for Device platform and Client app under sign-in conditions.

Subtask 1 - Try a different app in the What If analysis

1.Scroll back to the top of the What If tool.
2.In the Cloud apps, actions, or authentication context, select delete next to Sway and remove it..

3.Then select select cloud app to pick a new app.
4.Search for Office 365 Reports and choose it from the list, then use the Select button.

5.Scroll down to the bottom again.
6.Select the What If button.
7.You should see that the Block Bhoseswar from using Sway policy did not apply.

Summary

In this article, I demonstrated how to create and configure Conditional Access policies in Microsoft Entra ID, assign policies to specific users and cloud applications, define access controls, and validate policy behavior using the What If analysis tool. By testing policies before enforcement, administrators can confidently implement secure access controls, reduce the risk of unintended user lockouts, and strengthen their organization's identity security posture through a Zero Trust approach.

Securing User Identities with Multi-Factor Authentication (MFA) in Microsoft Entra ID

Rahimah Sulayman — Wed, 08 Jul 2026 21:54:23 +0000

Introduction

Passwords alone are no longer enough to protect user accounts from today's evolving cyber threats. Multi-Factor Authentication (MFA) adds an essential layer of security by requiring users to verify their identity using multiple authentication factors, significantly reducing the risk of unauthorized access caused by compromised credentials.

In this hands-on guide, I'll walk through configuring Multi-Factor Authentication in Microsoft Entra ID, including enabling and disabling per-user MFA, reviewing MFA service settings, and configuring account lockout policies. These practical exercises demonstrate how to strengthen identity security while balancing usability and administrative control in a modern cloud environment.

Exercise - Perform basic Multifactor Authentication tasks

In this exercise you will explore the MFA setup process and configure a basic MFA deployment.

This exercise should take approximately 10 minutes to complete.

Task 1 - Enable / Disable Per-user MFA settings

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, open the Identity submenu
4.Select Users and then select All users.
5.Look at the menu on the top of the new screen and find Per-user MFA.
6.Select Per-user MFA.

7.Put a mark in the box next to Bhogeswar Kalita.

8.Select Enable MFA from the top of the list.

9.Read the message box that pops up.

Note - This is a manual URL that you can email to the user, if you want to let them know to set up MFA.

10.Select Enable button.

11.Then select the Enforce button.

12.Note that after a few seconds enforced shows up next to Bhogeswar’s name.

Task 2 - Review the Service settings for MFA

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, open the Identity submenu.
4.Select Users and then select All users.
5.Select Per-user MFA item.

6.Select Service settings.

7.Review the settings you can configure:

Setting	What is it for
App passwords	There are some legacy apps that won’t work with MFA, use this setting to allow a user to keep using them.
Trusted IPs	If your company has a specifc set of IP-address ranges that are always known safe, you can allow users to by-pass MFA the logging in.
Verification options	Select the methods you are willing to allow users to use for their second factor of authentication.
Remember multifactor authentication on trusted device	If your users are using a device that you trust, like a company managed laptop, you can allow them to retain thier MFA approved status for a specified number of days.

8.Select the Discard button if you made any changes. Save if you want to deliberately make changes.
This is one method of configuring MFA for your users.

Task 3 - View MFA account lockout settings

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, open the Protection submenu.
4.Scroll to the bottom of the list and select Show more.
5.Select Multifactor authentication from the menu.
6.Select Account lockout from the menu.
7.Set the following lockout values:

Field	Value
Number of MFA denials to trigger account lockout	3
Minutes until account lockout counter is reset	180
Minutes until account is automatically unblocked	15

8.Select the Save option at the top of your screen.

Review some of the other configuration options you have on MFA like:

Fraud alert
Block / unblock users
Notifications

Summary

In this article, I explored the core aspects of configuring Multi-Factor Authentication (MFA) in Microsoft Entra ID. I demonstrated how to enable and manage per-user MFA, review and customize MFA service settings, and configure account lockout policies to protect against repeated unauthorized sign-in attempts. By implementing these security measures, organizations can significantly improve identity protection, reduce the risk of account compromise, and build a more resilient authentication framework for their cloud environments.

Mastering Self-Service Password Reset (SSPR) in Microsoft Entra ID

Rahimah Sulayman — Wed, 08 Jul 2026 18:59:21 +0000

Introduction

Forgotten passwords are one of the most common reasons users contact IT support, often resulting in lost productivity and increased administrative overhead. Self-Service Password Reset (SSPR) in Microsoft Entra ID empowers users to securely reset or unlock their accounts without requiring help desk assistance, improving both user experience and organizational security.

In this hands-on guide, I'll demonstrate how to configure Self-Service Password Reset in Microsoft Entra ID by enabling SSPR for specific users or groups, configuring authentication methods, managing registration settings, and customizing notification options. These configurations help organizations streamline identity management while maintaining strong security practices.

Exercise - Perform basic Self-Service Password Rest (SSPR) tasks

In this exercise you will learn where the self-service password reset feature is located in Microsoft Entra and explore the process to configure it.

This exercise should take approximately 15 minutes to complete.

Task 1 - View the SSPR properties for a specific group

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, open Password reset submenu.

4.Find the Self service password enabled bar.

Value	What it means
None	No users can use the SSPR feature
Selected	Only members of the selected group(s) can use SSPR
All	All users can use the SSPR feature

5.Set the value to Selected.
6.Select the text No groups selected.
7.Mark the Project233 group we created previously.
8.Use the Select button to complete your choice.

9.Save your configuration.

Subtask 1 - View SSPR authentication methods

1.Select Authentication methods from the menu within Password reset.

2.Select 1 as the value for Number of methods required to reset.

Note - this value represents how many different ways the user is required to sign-in to the password reset tool, before they are allowed to reset their password. Note that using a password is not an option.

3.Select Email, Mobile phone, and Mobile app code for Methods available to user.

Note - if you use Security Questions you have to specify the number of questions the user is required to create and answer.
4.Use the button at the top to Save your choices.

5.You have added an Authentication method to your self-service password reset.

Subtask 2 - View SSPR registration

1.Select Registration from the menu within Password reset.
2.Make sure the Require users to register when signing in? value is set to Yes.
3.Set the Number of days before users are asked to re-confirm… to 90 days.
4.Select Save to save your changes.

Subtask 3 - View SSPR reset notifications

1.Select Notifications from the menu within Password reset.
2.Leave the Notify users on password reset? at the default of Yes.
3.Change the Notify all admins when other admins reset their password? value to Yes.
4.Use the Save option to save your changes.

Summary

In this article, I explored the configuration of Self-Service Password Reset (SSPR) in Microsoft Entra ID, including enabling the feature for selected groups, configuring authentication methods, enforcing user registration, and managing password reset notifications. By implementing these settings, organizations can reduce help desk workload, improve operational efficiency, and provide users with a secure and convenient way to regain access to their accounts while strengthening overall identity security.

Strengthening Identity Security with Microsoft Entra ID Password Protection

Rahimah Sulayman — Wed, 08 Jul 2026 17:24:21 +0000

Introduction

Passwords remain one of the most common attack vectors in today's threat landscape, making strong password policies a critical component of identity security. Microsoft Entra ID provides built-in password protection capabilities that help organizations defend against brute-force attacks, password spraying, and the use of weak or commonly compromised passwords.

In this hands-on guide, I'll walk through configuring essential password protection settings in Microsoft Entra ID, including custom smart lockout policies, banned password lists, and enforcement options. These configurations help strengthen authentication security while improving the overall resilience of your organization's identity infrastructure.

Exercise - Perform basic Password Protection tasks

In this exercise you will explore the capabilities Microsoft Entra ID offers in protecting your password. You will see how you can automate and enforce a strong password, and use login restrictions to prevent password attacks.

This exercise should take approximately 5 minutes to complete.

Task 1 - View lock settings, and review duration and threshold values

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select Authentication methods submenu.

Note - You could also search on Password protection in the search bar at the top.

4.Select Password protection from the list.
5.Set the Custom smart lockout with the following values.

Field	Value	Description
Lockout threshold	5	How many times can you fail to login with a password before your account locks.
Lockout duration	30	How many seconds the account should lock when the threshold is reached.

Note - You can also configure a custom banned password list here.

6.Set Enforce custom list to Yes.
7.Enter the following values:

-Contoso
-London
-Widget

Lab Tip - Your lab is being performed for a company called Contoso, located in London, and it makes Widgets. By enter these three words you block them from being part or a whole of a password.

8.Set the value for Mode to Enforced.
9.Select the Save item at the top of the screen.

Summary

In this article, I demonstrated how to configure password protection in Microsoft Entra ID by reviewing smart lockout settings, defining lockout thresholds and durations, creating a custom banned password list, and enforcing password protection policies. These security measures help reduce the risk of unauthorized access by preventing weak passwords and limiting password-based attacks, making them an essential part of any modern identity security strategy.

Mastering Microsoft Entra ID: Managing Users, Groups, Dynamic Membership, and Licensing

Rahimah Sulayman — Wed, 08 Jul 2026 15:54:40 +0000

Introduction

In today's cloud-first world, identity has become the new security perimeter. Managing users is no longer just about creating accounts, it's about organizing identities efficiently, automating access, and simplifying administration at scale.

In this hands-on guide, I'll walk through essential Microsoft Entra ID group management tasks, including creating Microsoft 365 and Security groups, configuring dynamic membership rules, adding users and licenses to groups, and exploring how group-based licensing simplifies administration. Whether you're preparing for the AZ-104 exam or building real-world Azure administration skills, these are practical tasks every cloud administrator should know.

Exercise - Perform basic Group Management tasks

In this exercise you will explore the beginner level tasks associated with creating and using groups. You make a new group and assign members and set some basic access levels.

This exercise should take approximately 15 minutes to complete.
Task 1 - Create a Microsoft 365 group

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select Groups and then All groups.
4.Select New group option.

5.Enter the requested information:

Field	Value
Group type	Microsoft 365
Group name	Project233
Group description	This group consists of members of the new AI Simulation software with codename Project233
Membership type	Assigned

6.Under the Members heading, select No member selected.

7.Add Bhogeswar Kalita, by marking the box and choosing the Select button.
8.Select the Create button.

Task 2 - Create a Security group

5.Enter the requested information:

Field	Value
Group type	Security
Group name	Guest Users
Group description	This group has all the Guest users currently in the tenant.
Membership type	Dynamic User

6.Under the Dynamic user members heading, select Add dynamic query.

7.Create a dynamic query with the following values:

Field	Value
Property	userType
Operator	Equals
Value	Guest

8.Select the Save item from the top of the page.

9.Select the Create button.

Note - It will take up to 2 minutes for the group to be populate.
10.From the Groups select the Refresh item.
11.Select the Guest Users group we just created.
12.Select Members.

Task 3 - Add an existing user to a new group

6.Select + Add members from the menu near the top.

7.Mark the box next to External User and use the Select button.

Subtask 1 - Alternative method to add an existing user to a new group

1.Open the Users menu, then select All users.
2.Find and select External User from the list.
3.Select the Groups item from the menu.
4.Select the option to + Add memberships.

5.Mark an existing group and use the Select button to add them.

Task 4 - Add licenses and owners to a group

5.Choose the Owners option from the menu.

Note - Your tenant administrator will automatically be added as the owner of a group, if no owner is specified.
6.Select the + Add owners menu item.
7.Mark the box next to Bhogeswar and use the Select button.
8.Notice the new owner has been added to the group.

Subtask 1 - Adding a license to a group

1.Open a new tab in your browser.
2.Connect to Microsoft 365 admin cetner at https://admin.microsoft.com.
3.From the menu on the left, open the Billing section and select Licenses.
4.Select the Microsoft Power Automate Free license.

5.Select the + Assign licenses item.

7.Use the dropdown on the right side of the screen to select the Project 233 group created earlier.
Note: I I unassigned license to a group and created a security group called Project 233, which I assigned the license to. You cannot assign a Microsoft Power Automate Free license (or other Microsoft 365/Entra group-based licenses) to a Microsoft 365 group.
8.Use the Assign licenses button at the bottom of the screen.

9.Close the Your licenses are… notification.

10.Use the Refresh button to see the added group licenses.

Summary

In this article, I explored the fundamentals of group management in Microsoft Entra ID through a series of practical, hands-on exercises. I demonstrated how to create both Microsoft 365 and Security groups, configure dynamic user membership using rules, add users to existing groups, and assign Microsoft licenses through group-based licensing. Along the way, I also highlighted the differences between Microsoft 365 groups and Security groups, including why only Security groups support group-based licensing. These are essential identity and access management skills for Azure administrators and anyone preparing for real-world cloud administration or the AZ-104 certification.

Identity as the Perimeter: Scaling User Provisioning, RBAC, and Bulk Automation in Microsoft Entra ID

Rahimah Sulayman — Wed, 08 Jul 2026 11:41:39 +0000

Introduction

In modern cloud architecture, identity is the new security perimeter. As an infrastructure expands, managing access manually isn't just inefficient, it’s a massive security risk. Engineers must be able to scale user provisioning while maintaining strict governance and the principle of least privilege.

In this article, I break down a hands-on walkthrough of cloud identity engineering using Microsoft Entra ID. We will look past basic configurations to explore the real-world operational workflows every team needs: handling secure B2B guest invitations, mapping enterprise licensing, implementing granular administrative roles, and utilizing bulk automation pipelines to provision users at scale.

Here is the blueprint for building efficient, production-ready identity infrastructure in the cloud.

Exercise - Perform basic User Management tasks

In this exercise you will explore the beginner tasks of an Identity and Access administrator by creating and managing a user in Microsoft Entra ID. There are five common activities you will perform in your lab from creating a new user to assigning them roles and licenses.

This exercise should take approximately 10 minutes to complete.

Task 1 - Create a new user

1.Open the Microsoft Entra admin center at https://entra.microsoft.com.
2.Log in using the credentials for your tenant.
3.From the menu on the left, select User and then All users.
4.Select + New user and then pick the Create new user option.

5.Enter the requested information:

Field	Value
User principal name	BhogeswarK
Display name	Bhogeswar Kalita

6.Leave the Mail nickname as is.
7.Make a copy of the Password (auto-generated) and store it in Notepad. You will need it later.
8.Leave Accounted enabled checked.
9.Select the Properties tab.

10.Set the values for first and last name:

Field	Value
First name	Bhogeswar
Last name	Kalita

11.Note that you can set the User type to Member. If you pick Guest, it will restrict the users capabilities.

12.Scroll down to the bottom of the page.
13.Set the Usage location to United States or to whatever region you are in.
14.Select the Review + create button.

15.Select Create.

Subtask 1 - Log in to confirm user

1.Open an InPrivate browsing window.
2.Connect to the Microsoft Entra admin center at the link https://entra.microsoft.com.
3.Enter the username and password you just created.

Field	Value
Username	BhogeswarK@`your tenant name`.onmicrosoft.com
Password	`Auto generated password you saved`

4.If prompted follow the on-screen instructions to complete MFA setup.

5.Feel free to explore the Microsoft Entra admin center for a minute.

6.Close the InPrivate browsing window.

Task 2 - Add a license to the user

1.Open a new tab in your browser.
2.Connect to the Microsoft 365 admin center at https//:admin.microsoft.com.

3.If prompted, log in using the credentials for your tenant.
4.Find the menu on the left side of the screen.
5.Open the Billing item in the menu.
6.Select Licenses from the list.
7.When the list of licenses appears, select Microsoft Power Automate Free.

8.Select the + Assign licenses item.

9.Choose Brogeswar from the list (user created in previous task).
10.Select the Assign licenses button at the bottom of the page.

11.Notice the message that you have successfully assigned a license.

12.Close the tab with Microsoft 365 admin center.

Task 3 - Invite an external user to your tenant

1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com.
2.If prompted, log in using the credentials for your tenant.
3.From the menu on the left, open the Identity menu.
4.Select Users then select All users.
5.At the top of the page select + New User.
6.Choose the option to Invite external user from the dropdown.

7.Enter the information for your new external user:

Field	Value
Email	ExtUser@testemail.com
Display name	External User
Message	Thank you for joining the company for this short work project. We look forward to building this project together.

8.Select the Review + Invite button.
9.Select Invite.

Task 4 - Assign a role to a user

1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com..
2.If prompted, log in using the credentials for your tenant.
3.In the left menu find the Identity section. Open it if not already opened.
4.Select Users then select All users.
5.Choose the user Bhogeswar Kalita create in the earlier task.

6.From the newly opened menu select Assigned roles.
7.At the top of the screen select + Add assignments.

8.From the Select role dropdown menu chose the role Attribute Definition Reader.

9.Select the Next button when it becomes available.
10.Choose the option Eligible for Assignment type.
Select Assign.

Subtask 1 - Alternate method to assign a role to a user

1.Look at the Identity menu section on the left side of the screen.
2.Select the Show more option to see the full Identity menu.
3.From the list of items in the Identity menu, expand the Roles & admins section.
4.Select Roles & admins.
5.Select Attribute Log Reader from the list of roles.

6.From the top of the screen select + Add assignment.
7.From the Select member(s) select the No member selected text.
8.From the list of user choose Bhogeswar Kalita.
9.Choose the Select button at the bottom.
10.Select the Next button.

11.On the Add assignments page choose Active for the Assignment type.
12.Note that you have to enter a justification for this role / user assignment.
13.Enter the justification User will be working as an Attribute log reader as their primary job. into the box.
14.Select Assign.

Notice the Remove|Update option.

Task 5 - Bulk import users

1.If not already open - Open a browser and connect to the Microsoft Entra admin center at https://entra.microsoft.com.
2.If prompted, log in using the credentials for your tenant.
3.From the Identity menu, select Users and then select All users.
4.From the top of the page, select the Bulk operations drop-down arrow and then select Bulk create.

Note - Selecting Bulk create will open a new tile. This tile provides a Download link to a template file that you will edit to populate with your user information and upload to add the bulk creation of users.

5.Select Download to see a sample bulk user CSV file.

Note - The .csv template provides you with the fields included with the user profile. This includes the required username, display name, and initial password. You can also complete optional fields, such as Department and Usage location, at this time. You do not need to fill out all the fields.

Lab Tip - A sample CSV has been provided in the Allfiles/Lab1 folder – APL0501-BulkUser.csv.
6.Open Notepad.
7.Open the SC300BulkUser.csv file.
8.Search and replace the existing value «>> with Your actual domain name.
9.Save the file.
10.On the Bulk create users dialog, select the file folder icon on step 3.
11.Path to the Allfiles/Lab1 folder and select APL0501-BulkUser.csv file.
12.Select Open.

13.Wait for the notification that the file uploaded successfully. Select the Submit button to add the users.

Note - After the users have been created, you will be prompted that the creation has succeeded.

14.Close the Bulk create users dialog.
15.Check the list of users to see your bulk created users.

In summary, Identity is the foundation of secure cloud architecture. Managing access manually isn't just inefficient - it’s an operational risk.

This article breaks down a hands-on walkthrough of cloud identity engineering using Microsoft Entra ID. From enforcing the principle of least privilege with granular administrative roles and secure B2B guest access to scaling user provisioning through bulk automation pipelines, here is the blueprint for building secure, production-ready identity infrastructure.

From Fork to Pull Request: A Practical GitHub Collaboration Workflow

Rahimah Sulayman — Sat, 04 Jul 2026 14:11:19 +0000

Modern software development is built on collaboration, and GitHub is at the center of that workflow.
Every contribution to an open-source project starts with a single Pull Request. This article walks through a practical GitHub collaboration workflow, from forking a repository to submitting production-style Pull Requests for review using the same process followed by development teams.

This project reinforced practical version control skills that are essential in Cloud and DevOps environments, including working with feature branches, synchronizing forks, writing meaningful commits, and contributing through Pull Requests.

Step 1: Fork the Repository

The workflow began by creating a personal fork of the original repository. This provided an independent copy where changes could be made safely without affecting the upstream project.

The fork serves as the working repository for development before changes are proposed back to the original project.

Step 2: Clone the Repository

After forking the project, I cloned my fork to my local development environment using Git. This enabled me to work on the project locally while maintaining a connection to my GitHub repository.

The local repository became the workspace for implementing changes, reviewing modifications, and managing version history before publishing updates.

Step 3: Configure the Upstream Repository

To keep my fork synchronized with the original project, I configured the upstream repository as an additional remote.

This made it possible to fetch the latest changes from the original project before starting new work, ensuring my local repository stayed aligned with the latest codebase.

Step 4: Create a Feature Branch

A dedicated feature branch was created to isolate the changes from the main branch, following a standard collaborative Git workflow.

Step 5: Contribute to the Project

I updated the project documentation by adding my contributor profile and committed the changes using a descriptive commit message.

Step 6: Push the Feature Branch

The completed work was pushed to my GitHub fork, making it ready for review through a Pull Request.
The arrow points to the Pull Request link.

The link opened a Pull Request through which the feature branch was submitted for review, thereby allowing the repository owner to review and merge the contribution.
The Pull Request was approved and merged.

Step 7: Submit a Documentation Improvement

After the initial contribution, I created a second feature branch to improve the project's README by clarifying the browser prerequisites and submitted another Pull Request.

Summary

This repository reflects hands-on experience with collaborative software development using Git and GitHub. It showcases practical skills in branching strategies, repository synchronization, documentation contributions, and Pull Request-based collaboration—core practices used across modern engineering and DevOps teams.

I look forward to applying these skills in professional environments while continuing to expand my expertise in Cloud and DevOps technologies.

Lab Guide: Configuring Microsoft Defender for Cloud for Server Protection

Rahimah Sulayman — Tue, 23 Jun 2026 12:28:05 +0000

Note: To complete this lab, you will need an Azure subscription. in which you have administrative access.

The main goal of this exercise is to provide hands-on experience in configuring and enabling Microsoft Defender for Servers Plan 2 within an Azure subscription. This will allow you to monitor and protect your cloud resources against security threats.

Skilling tasks

Configuring Microsoft Defender for Cloud Enhanced Security Features for Servers.
Review the ehanced security features for Microsoft Defender for Servers Plan 2.

Estimated Lab Duration: 5 minutes

Exercise instructions

Configuring Microsoft Defender for Cloud Enhanced Security Features for Servers
Step 1: Start a browser session and sign-in to the Azure portal menu.

Step 2: In the Azure portal, in the Search resources, services, and docs text box at the top of the Azure portal page, type Microsoft Defender for Cloud and press the Enter key.

Step 3: On the Microsoft Defender for Cloud,Management blade, go to the Environment settings. Expand the environment settings folders until the subscription section is displayed, then click the subscription to view details.

Step 4: In the Settings blade, under Defender plans, expand Cloud Workload Protection (CWP).

Step 5: From the Cloud Workload Protection (CWP) Plan list, select Servers. On the right side of the page, change the Status from Off to On, then click Save.

Step 6: To review the details of Microsoft Defender for Servers Plan 2, select Change plan >.

Note: Enabling the Cloud Workload Protection (CWP) Servers plan from Off to On enables Microsoft Defender for Servers Plan 2.

Results: You have enabled Microsoft Defender for Servers Plan 2 on your subscription.

Step 7: You can toggle back to Off, if you do not want to use the plan now.

Git Engineering Workflow 1

Rahimah Sulayman — Fri, 19 Jun 2026 18:03:19 +0000

Introduction

This article walks through a complete Git-based development workflow: from creating a repository to branching, committing changes, opening a pull request, and merging into main. It demonstrates how modern teams collaborate using version control, feature isolation, code review, and CI/CD principles to deliver software in a structured and reliable way.

Lab Requirements

Before starting this Git Engineering Workflow Lab, ensure the following tools and accounts are available:

Software

Git installed on your local machine
Visual Studio Code (or another code editor)
GitHub CLI (gh) installed and authenticated

Accounts

A GitHub account
Access to create repositories on GitHub

Basic Knowledge

Familiarity with the command line or terminal
Basic understanding of files and folders
Fundamental Git concepts such as repositories, commits, and branches (helpful but not mandatory)

Lab Objectives

By completing this lab, you will learn how to:

Create and clone Git repositories
Work with feature branches
Stage and commit changes
Push code to GitHub
Create and review Pull Requests
Merge code into the main branch
Understand the role of CI/CD in modern software development
Implement a basic GitHub Actions workflow for Continuous Integration

Expected Outcome

At the end of the lab, you will have a fully functional GitHub repository that demonstrates a professional Git workflow, including branching, code review, merging, and a working CI pipeline using GitHub Actions.

Step 1: Creating the Repository

Before any code can be cloned, committed, or pushed, a repository must first be created. A Git repository serves as the central location where project files and their version history are stored.

To begin this exercise, I created a new repository on GitHub by:

Logging into my GitHub account
Clicking New Repository
Naming the repository git-engineering-flow-lab
Selecting Public visibility
Initializing the repository with a README.md file

Once the repository was created, GitHub generated a remote location where all future changes to the project would be stored.

Step 2: Cloning the Repository

After creating the repository on GitHub, the next step was to clone it to my local machine.
At this stage, the repository existed only on GitHub. To start working on it locally, I needed to create a copy on my computer using Git's cloning feature.
Cloning a repository does much more than simply downloading files. When a repository is cloned, Git downloads:

The project files
The complete commit history
Branch information
Repository configuration

This creates a fully functional local copy of the project while maintaining a connection to the remote repository hosted on GitHub.

To clone the repository, I copied its HTTPS URL from GitHub and ran:
git clone https://github.com/rahimahisah17/git-engineering-flow-lab.git

Git then created a new folder named git-engineering-flow-lab and downloaded the repository contents into it.

At this point, I had two copies of the repository:

A remote repository hosted on GitHub
A local repository stored on my computer

This local repository would serve as my workspace for making changes before pushing them back to GitHub.

Step 3: Creating a Feature Branch
After cloning the repository, the next step in the Git workflow is to create a feature branch. This is where development work happens in isolation from the main codebase.

Working directly on the main branch is discouraged because it can introduce unstable or unfinished changes into production code. Instead, feature branches allow developers to safely build new functionality without affecting the stable version of the project.

To begin working on a new feature, I created and switched to a new branch using the following command:

git checkout -b feature/add-login-button

This command performs two actions at once:

Creates a new branch called feature/add-login-button
Switches to that branch immediately
So all new work happens in isolation

You can confirm the branch was created and active by running:

git branch

Feature branches are a core part of modern Git workflows because they:

Keep the main branch stable and deployable
Allow multiple developers to work independently
Enable experimentation without risk to production code
Make code review easier through Pull Requests

Step 4: Write Code and Commit Changes

After creating a feature branch and adding a new file to the project, the next step in the Git workflow is to write code (make changes) and commit them.

In this step, I created a simple file called login.txt to represent the login feature being developed.

Inside the project directory, I added content to a new file:

echo Login button feature added > login.txt

This command creates a file named login.txt and writes a simple message into it. In a real project, this step would involve writing actual application code instead of a text file.

To check the state of the repository, I ran:

git status

Then I staged the file using:

git add login.txt

Staging tells Git which changes should be included in the next commit. At this point, the file moved from “untracked” to “ready to be committed.”

Then I created a commit:

git commit -m "feat: add login"

This command creates a commit, which is a permanent snapshot of the project at that point in time.

A commit is one of the most important concepts in Git. It acts like a save point, allowing developers to track progress, revert changes if needed, and maintain a clear history of the project.

By committing small and meaningful changes, the project history remains clean, readable, and easy to manage.

Step 5: Push Branch to Remote Repository

After committing my changes locally, the next step was to upload my work to GitHub. This is done by pushing the feature branch to the remote repository.

At this stage, my changes existed only on my local machine. To share them and prepare for collaboration, I needed to synchronize my local branch with GitHub.

I ran the following command:

git push -u origin feature/add-login-button

This command performs these important actions:

Pushes the branch to GitHub
Uploads the local feature/add-login-button branch to the remote repository
Sets upstream tracking (-u)
Links the local branch to the remote branch
This allows future pushes to be done using only: git push

Pushing a branch is a key part of modern Git workflows because it:

Shares your work with the remote repository (GitHub)
Makes your changes visible to teammates
Prepares the branch for pull request creation
Keeps local and remote repositories in sync

Without pushing, your work remains only on your local machine and cannot be reviewed or merged.

Step 6: Open Pull Request (PR)

After pushing my feature branch to GitHub, the next step was to open a Pull Request (PR). A Pull Request is a way of proposing changes so they can be reviewed before being merged into the main branch.

This is a key part of collaborative development, where code is not directly pushed into production but instead reviewed first.

To create the Pull Request, I used the GitHub CLI:

gh pr create --fill

This command automatically:

Creates a Pull Request on GitHub
Compares the feature branch (feature/add-login-button) with main
Uses the latest commit message as the PR title
Auto-fills the PR description based on commit history

After running the command, GitHub generated a URL to view the Pull Request in the browser.

Instead of directly pushing changes to main, developers work on feature branches and submit Pull Requests for review.

A Pull Request represents a proposal to merge changes. It is not yet part of the main codebase. This ensures that every change is reviewed, discussed, and approved before integration.

Even in solo projects, PRs help simulate real-world engineering workflows.

Step 7: Code Review

After opening the Pull Request, the next stage in the Git workflow is code review. This is where changes are inspected before being merged into the main branch.

Even though this project was done individually, this step simulates how teams review code in real-world development environments.

To inspect the Pull Request directly from the terminal, I ran:

gh pr view --comments

The terminal displayed the Pull Request summary:

PR Title: feat: add login file
Status: Open
Branch: feature/add-login-button → main
Comments: None
Checks: No checks

No description:

This means no additional PR description was manually added
GitHub only used the commit message as the PR title

No checks:

This indicates there is no CI/CD pipeline configured for this repository
In real-world projects, this area would show automated test results or build status

Code review is a critical step in professional software development because it:

Helps catch bugs before merging
Improves code quality
Encourages collaboration and feedback
Ensures consistency in the codebase

Even when working alone, reviewing your own PR helps reinforce good development habits.

A Pull Request is not just a merge request BUT a discussion point for changes. This is where code is validated before becoming part of the main branch.

This step completes the review stage of the Git workflow, preparing the changes for final integration into the main branch.

Step 8: Merge Pull Request into Main

After completing code review, the final step in the Git workflow is to merge the Pull Request into the main branch. This is where the feature officially becomes part of the project’s primary codebase.

At this point, the feature branch has been developed, reviewed, and approved for integration.

To complete the merge using the GitHub CLI, I ran:

gh pr merge --squash

This command performs several actions automatically:

Merges the Pull Request into the main branch
Squashes all commits into one meaningful commit
Closes the Pull Request
Updates the repository history on GitHub

In modern Git workflows, feature branches are temporary. Once their work is completed and merged, they are deleted or left inactive. The main branch remains the single source of truth for production-ready code.

This step completes the full Git workflow cycle:
write code → commit → push → review → merge → deliver to main

Step 9: CI/CD Deployment (Automated Delivery)

After merging the Pull Request into the main branch, the final stage in a modern Git workflow is CI/CD (Continuous Integration and Continuous Deployment).

At this point, the responsibility of delivering the code shifts from the developer to an automated system.

What triggers CI/CD?

In most real-world projects, a CI/CD pipeline is automatically triggered when:

Code is pushed to a repository (git push)
A Pull Request is merged into main

In this workflow, the merge into main represents a production-ready change that activates the pipeline.

What happens in the pipeline?

Once triggered, the CI/CD system typically performs several automated tasks.

Continuous Integration (CI):

Runs automated tests
Validates code quality
Ensures new changes do not break existing functionality

Continuous Deployment (CD):

Builds the application
Packages the code
Deploys it to a staging or production environment

CI/CD removes manual deployment steps from the development process.

Instead of developers copying files to servers manually, everything is handled by automation.

Once code is merged into main, it can automatically be tested, built, and deployed without human intervention.

Why CI/CD is important

This approach improves software delivery by:

Reducing human error in deployments
Speeding up release cycles
Ensuring consistent builds
Allowing rapid feedback from production systems

CI/CD represents the final stage of the Git workflow. It ensures that every approved change can safely and automatically reach production.
This completes the full development cycle:

code → commit → push → review → merge → deploy

To reinforce the CI/CD concept, I created a GitHub Actions workflow and successfully triggered it by pushing changes to the main branch. The workflow executed automatically and completed successfully, demonstrating how modern development teams automate validation and delivery processes.

Summary

This article demonstrates a complete Git workflow used in modern software development. It covers creating a repository, cloning it locally, working on a feature branch, making and committing changes, pushing to GitHub, opening a pull request, performing code review, merging changes into the main branch, and understanding CI/CD deployment. The process highlights how developers collaborate, maintain code quality, and automate delivery using Git and GitHub.
NOTE: A GitHub Actions workflow was implemented to demonstrate Continuous Integration (CI). While a deployment target was not configured, the workflow successfully validated the automation process that forms the foundation of a complete CI/CD pipeline.

Create DNS zones and configure DNS settings

Rahimah Sulayman — Tue, 26 May 2026 13:12:28 +0000

Introduction

Reliable name resolution is a critical part of modern cloud infrastructure, especially in secure, private network environments. In this hands-on guide, we’ll configure Azure Private DNS to enable seamless internal communication using custom domain names instead of IP addresses. The exercise covers creating a private DNS zone, linking it to a virtual network, and configuring DNS records for backend resources: demonstrating practical Azure networking and cloud administration skills used in real-world enterprise environments.

Scenario

Your organization requires workloads to use domain names instead of IP addresses for internal communications. The organization doesn’t want to add a custom DNS solution. You identify these requirements.

A private DNS zone is required for contoso.com.
The DNS will use a virtual network link to app-vnet.
A new DNS record is required for the backend subnet.

Skilling tasks

Create and configure a private DNS zone.
Create and configure DNS records.
Configure DNS settings on a virtual network.

Exercise instructions

Note: This exercise requires the Lab 01 virtual networks and subnets to be installed. A template is provided if you need to deploy those resources.
Create a private DNS zone

Azure Private DNS provides a reliable, secure DNS service to manage and resolve domain names in a virtual network without the need to add a custom DNS solution. By using private DNS zones, you can use your own custom domain names rather than the Azure-provided names.

1.On the Azure portal, search for and select Private dns zones.

2.Select + Create and configure the DNS zone.

Property	Value
Subscription	Select your subscription
Resource group	RG1
Name	`private.contoso.com`
Region	East US

3.Select Review + create and then select Create.

4.Wait for the DNS zone to deploy, and then select Go to resource.

Create a virtual network link to your private DNS zone

To resolve DNS records in a private DNS zone, resources must be linked to the private zone. A virtual network link associates the virtual network to the private zone.

1.In the portal, continue working on the private.contoso.com DNS zone.

2.In the DNS Management blade, select + Virtual network links.

3.Select + Add and configure the virtual network link.

Property	Value
Link name	`app-vnet-link`
Virtual network	app-vnet
Enable auto registration	Enabled

4.Select Create and wait for the deployment to finish. If necessary, Refresh the page.

Create a DNS record set

DNS records provide information about the DNS zone.

1.In the portal, continue working on the private.contoso.com DNS zone.

2.In the DNS Management blade, select + Recordsets.

3.Notice that two A records have automatically been created for each of the virtual machines.

4.Select + Add and configure a record set. When finished select Add.

Property	Value
Name	`backend`
Type	A
TTL	1
IP address	10.1.1.5

Note: This record set implies there is a virtual machine in app-vnet with a private IP address of 10.1.1.5.

Key takeaways
Here are the main takeaways:

Azure DNS is a cloud service that allows you to host and manage domain name system (DNS) domains, also known as DNS zones.
Azure DNS public zones host domain name zone data for records that you intend to be resolved by any host on the internet.
Azure Private DNS zones allow you to configure a private DNS zone namespace for private Azure resources.
A DNS zone is a collection of DNS records. DNS records provide information about the domain.

Summary

In this exercise, we configured Azure Private DNS to enable secure and reliable internal name resolution within a virtual network. We created a private DNS zone for private.contoso.com, linked it to the app-vnet virtual network, and configured DNS record sets for backend resources. This setup demonstrates how Azure Private DNS simplifies internal communication by allowing workloads to use custom domain names instead of IP addresses, while maintaining centralized and secure DNS management in Azure.

Configure network routing

Rahimah Sulayman — Tue, 26 May 2026 12:00:41 +0000

Introduction

In modern cloud environments, controlling how network traffic flows is just as important as securing the workloads themselves. In this guide, we’ll configure custom network routing in Azure by creating route tables, associating them with subnets, and directing outbound traffic through an Azure Firewall for centralized inspection and filtering. This hands-on exercise demonstrates practical cloud networking and security skills that are essential for designing secure, enterprise-grade Azure infrastructures.

Scenario

To ensure the firewall policies are enforced, outbound application traffic must be routed through the firewall. You identify these requirements.

A route table is required. This route table will be associated with the frontend and backend subnets.
A route is required to filter all outbound IP traffic from the subnets to the firewall. The firewall’s private IP address will be used.

Skilling tasks

Create and configure a route table.
Link a route table to a subnet.

Exercise instructions

Create a route table

Azure automatically creates a route table for each subnet within an Azure virtual network. The route table includes the default system routes. You can create route tables and routes to override Azure’s default system routes.

Record the private IP address of app-vnet-firewall

1.In the search box at the top of the portal, enter Firewall. Select Firewall in the search results.

2.Select app-vnet-firewall.

3.Select Overview and record the Private IP address.

Add the route table

1.In the search box, enter Route tables. When Route table appears in the search results, select it.

2.In the Route table page, select + Create and create the route table.

Property	Value
Subscription	Select your subscription
Resource group	RG1
Region	East US
Name	`app-vnet-firewall-rt`

3.Select Review + create and then select Create.

4.Wait for the route table to deploy, then select Go to resource.

Associate the route table to the subnets

1.In the portal, continue working with the route table, select app-vnet-firewall-rt.

2.In the Settings blade, select Subnets and then + Associate.

3.Configure an association to the frontend subnet, then select OK.

Property	Value
Virtual network	app-vnet (RG1)
Subnet	frontend

4.Configure an association to the backend subnet, then select OK.

Property	Value
Virtual network	app-vnet (RG1)
Subnet	backend

Create a route in the route table

1.In the portal, continue working with the route table, select app-vnet-firewall-rt.

2.In the Settings blade, select Routes and then + Add.

3.Configure the route, then select Add.

Property	Value
Route name	outbound-firewall
Destination type	IP addresses
Destination IP addresses/CIDR range	0.0.0.0/0
Next hop type	Virtual appliance
Next hop address	private IP address of the firewall

Key takeaways

Here are the main takeaways:

Network traffic in Azure is automatically routed across Azure subnets, virtual networks, and on-premises networks. System routes control this routing.
User-defined routes override the default system routes so traffic can be routed through a network virtual appliances (NVAs).
Network virtual appliances (NVAs) control the flow of network traffic. Examples of NVAs are firewalls, load balancers, and routers.
Route tables contain routing information and are associated with a subnet.

Summary

In this exercise, we configured Azure network routing to ensure outbound traffic is securely inspected through an Azure Firewall. We created a custom route table, associated it with the frontend and backend subnets, and added a user-defined route that forwards all outbound traffic to the firewall’s private IP address. This setup demonstrates how Azure route tables and network virtual appliances work together to provide centralized traffic control, improved security, and enterprise-grade network management.

Create and configure Azure Firewall

Rahimah Sulayman — Mon, 25 May 2026 21:21:10 +0000

Introduction

As cloud applications scale, simple subnet-level filtering isn't enough to defend against sophisticated attack vectors. This project demonstrates how to implement a centralized network security strategy in Microsoft Azure by deploying Azure Firewall to protect corporate workloads (app-vnet). Moving beyond basic port restrictions, this guide covers how to design and enforce Firewall Policies,including Layer 7 Application Rules to securely lock down egress traffic to Azure DevOps pipelines (dev.azure.com) and Network Rules to safeguard core infrastructure traffic like DNS resolution.

Scenario

Your organization requires centralized network security for the application virtual network. As the application usage increases, more granular application-level filtering and advanced threat protection will be needed. Also, it is expected the application will need continuous updates from Azure DevOps pipelines. You identify these requirements.

Azure Firewall is required for additional security in the app-vnet.
A firewall policy should be configured to help manage access to the application.
A firewall policy application rule is required. This rule will allow the application access to Azure DevOps so the application code can be updated.
A firewall policy network rule is required. This rule will allow DNS resolution.

Skilling tasks

Create an Azure Firewall.
Create and configure a firewall policy
Create an application rule collection.
Create a network rule collection.

Create Azure Firewall subnet in our existing virtual network

1.In the search box at the top of the portal, enter Virtual networks. Select Virtual networks in the search results.

2.Select app-vnet.

3.Select Subnets.

4.Select + Subnet.

5.Enter the following information and select Add.

Property	Value
Name	AzureFirewallSubnet
Address range	10.1.63.0/26

Note: Leave all other settings as default.

Create an Azure Firewall

1.In the search box at the top of the portal, enter Firewall. Select Firewall in the search results.

2.Select + Create.

3.Create a firewall by using the values in the following table. For any property that is not specified, use the default value.

Note: Azure Firewall can take a few minutes to deploy.

Property	Value
Resource group	RG1
Name	app-vnet-firewall
Firewall SKU	Standard
Firewall management	Use a Firewall Policy to manage this firewall
Firewall policy	select Add new
Policy name	fw-policy
Region	East US
Policy Tier	Standard
Choose a virtual network	Use existing
Virtual network	app-vnet (RG1)
Public IP address	Add new: fwpip
Enable Firewall Management NIC	uncheck the box

4.Select Review + create and then select Create.

Update the Firewall Policy

1.In the portal, search for and select Firewall Policies.

2.Select fw-policy.

Add an application rule

1.In the Rules blade, select Application rules and then Add a rule collection.

2.Configure the application rule collection and then select Add.

Property	Value
Name	`app-vnet-fw-rule-collection`
Rule collection type	Application
Priority	`200`
Rule collection action	Allow
Rule collection group	DefaultApplicationRuleCollectionGroup
Name	`AllowAzurePipelines`
Source type	IP address
Source	`10.1.0.0/23`
Protocol	`https`
Destination type	FQDN
Destination	`dev.azure.com, azure.microsoft.com`

Note: The AllowAzurePipelines rule allows the web application to access Azure Pipelines. The rule allows the web application to access the Azure DevOps service and the Azure website.

Add a network rule

1.In the Rules blade, select Network rules and then Add a rule collection.

2.Configure the network rule and then select Add.

Property	Value
Name	`app-vnet-fw-nrc-dns`
Rule collection type	Network
Priority	`200`
Rule collection action	Allow
Rule collection group	DefaultNetworkRuleCollectionGroup
Rule	AllowDns
Source	`10.1.0.0/23`
Protocol	UDP
Destination ports	`53`
Destination addresses	1.1.1.1, 1.0.0.1

Verify the firewall and firewall policy status

1.In the portal search for and select Firewall.

2.View the app-vnet-firewall and ensure the Provisioning state is Succeeded. This may take a few minutes.

3.In the portal serach for and select Firewall policies.

4.View the fw-policy and ensure the Provisioning state is Succeeded. This may take a few minutes.

Summary

This project demonstrates the implementation of a centralized network security perimeter within Microsoft Azure using Azure Firewall and Firewall Policies. By shifting from decentralized security rules to a unified firewall model, this architecture enforces granular Layer 4 (network) and Layer 7 (application) filtering to protect cloud workloads from malicious egress traffic while enabling secure CI/CD automation.