Note: Premium P1 or P2 licensing of Microsoft Entra is required to implement Microsoft Entra Conditional Access. A P2 license should be active on your account before attempting this lab.

1. From your local computer, start a web browser, navigate to the Azure portal, and sign in by providing your Odl_user credentials.
2. In the Azure portal, search for and select Microsoft Entra ID to navigate to the Microsoft Entra tenant associated with the Azure subscription you are using for this lab.
3. On the Microsoft Entra ID blade, in the vertical menu bar on the left side, in the Manage section, click Users.
4. On the Users blade, select cpoF67-User2.
5. On the cpoF67-User2 blade, in the toolbar, click Edit Properties, select the Settings tab, in the Usage location dropdown list, select the country where the lab environment is located and, in the toolbar, click Save.
6. On the cpoF67-User2 blade, in the Overview | Basic info section, identify the user principal name of the cpoF67-User2 account.

   Note: Record this value — you will need it later in this lab.

7. On the Users | All users blade, select your ODL_User… account and repeat the previous step in case your account does not have the Usage location assigned.

   Note: The Usage location property must be set in order to assign Microsoft Entra Premium P2 licenses to user accounts.

8. In the Azure portal, navigate back to the Overview blade of the Microsoft Entra tenant and, in the vertical menu bar on the left side, in the Manage section, click Licenses.
9. On the Licenses | Overview blade, in the vertical menu bar on the left side, in the Manage section, click All products.
10. On the Licenses | All products blade, under manage, in the toolbar, select All products.

    Note: The Microsoft Entra P2 license will be available in your ODL account during the second half of the semester. Your instructor will provide more information about this in class.

11. For adding, removing, and reprocessing licensing assignments, go to the Microsoft 365 Admin Center. On the Microsoft 365 Admin Center blade, click Microsoft Entra ID P2, select your ODL_User account and, from the top menu, select Unassign licenses.
12. On the same page, click + Assign licenses. From the Assign licenses to users page, select and assign the license to cpoF67-User2.
13. Back on the License details blade, click cpoF67-User2 and verify that all options are enabled. From the All users blade, click cpoF67-User2 and, from the Licenses tab, verify that the license state is Active. Screenshot must show your Odl_user account, the cpoF67-User2 account with the Microsoft Entra ID P2 license assigned and its state Active

1. From the Azure portal, navigate back to the Overview blade of the Microsoft Entra tenant and, in the vertical menu on the left side, in the Manage section, click Security.
2. On the Security | Getting started blade, in the vertical menu on the left side, in the Protect section, click Identity Protection.
3. On the Identity Protection | Dashboard blade, in the vertical menu on the left side, in the Protect section, click MFA registration policy (if necessary, refresh the web browser page).
4. On the Identity Protection | MFA registration policy blade, in the Assignments section, click All users, on the Include tab, click the Select individuals and groups option, in Select users, click cpoF67-User2, click Select, at the bottom of the blade, set the Enforce policy switch to On, and click Save. Screenshot must show your Odl_user account, the MFA registration policy assigned to cpoF67-User2 with the Enforce policy switch set to On

1. On your local computer, open an InPrivate web browser session, navigate to the Azure portal, and sign in by providing the cpoF67-User2 user principal name you identified earlier in this exercise and the password you set when creating this user account.
2. When presented with the message More information required, click Next. This will automatically redirect your browser to the Microsoft Authenticator page.
3. On the Additional security verification page, in the Step 1: How should we contact you? section, select your preferred authentication method and follow the instructions to complete the registration process. Screenshot must show your Odl_user account, the Additional security verification page for cpoF67-User2 with the authentication method selected
4. On the Azure portal page, in the upper right corner, click the icon representing the user avatar, click Sign out, and close the InPrivate browser window.

Note: In this task, you will configure a Microsoft Entra-based Conditional Access policy that requires MFA to sign in to an Azure Virtual Desktop session. The policy will also enforce reauthentication after the first 4 hours following a successful authentication.

1. On your local computer, in the web browser displaying the Azure portal, navigate back to the Overview blade of the Microsoft Entra tenant and, in the vertical menu on the left side, in the Manage section, click Security.
2. On the Security | Getting started blade, in the vertical menu on the left side, in the Protect section, click Conditional Access.
3. On the Conditional Access | Policies blade, in the toolbar, click + Create new policy.
4. On the New blade, in the Name text box, type <studentID>-F67-avdpolicy1.
5. In the Assignments section, select Users, in the What does this policy apply to? drop-down list, ensure that Users and groups is selected, in the Select Users and groups section, select the Users and groups checkbox, on the Select blade, click cpoF67-User2, and then click Select.
6. In the Assignments section, click Target resources, ensure that in the Select what this policy applies to, the Resources (formerly Cloud apps) option is selected, click the Select resources option, on the Select specific resource blade, in the Search textbox, enter Azure Virtual Desktop, in the listing of results, select the checkbox next to the Azure Virtual Desktop entry, and then in the Search textbox, enter Microsoft Remote Desktop, select the checkbox next to the Microsoft Remote Desktop entry, and click Select.
7. In the Assignments section, click Conditions, click Client apps, on the Client apps blade, set the Configure switch to Yes, ensure that both the Browser and Mobile apps and desktop clients checkboxes are selected, and click Done.
8. In the Access controls section, click Grant, on the Grant blade, ensure that the Grant access option is selected, select the Require multi-factor authentication checkbox and click Select.
9. In the Access controls section, click Session, on the Session blade, select the Sign-in frequency checkbox, in the first textbox, type 4, in the Select units dropdown list, select Hours, leave the Persistent browser session checkbox cleared, and click Select.
10. Set the Enable policy switch to On.
11. On the New blade, click Create. Screenshot must show your Odl_user account, the <studentID>-F67-avdpolicy1 Conditional Access policy requiring multi-factor authentication with 4-hour sign-in frequency and Enable policy set to On

1. On the local computer, in the web browser window displaying the Azure portal, open the PowerShell shell session within the Cloud Shell pane.
2. From the PowerShell session in the Cloud Shell pane, run the following to start the AVD session hosts (replace <sName> with your name):
   Get-AzVM -ResourceGroup <sName>-cpoF67-21e-RG | Start-AzVM

   Note: Wait until the command completes and all the Azure VMs are running.

3. On your local computer, open an InPrivate web browser session. In the InPrivate web browser session, navigate to the Azure Virtual Desktop HTML5 web client page at https://rdweb.wvd.microsoft.com/arm/webclient.
4. Note: Verify that this will automatically trigger authentication via MFA. Screenshot must show your Odl_user account, the Azure Virtual Desktop web client MFA authentication prompt
5. In the Enter code pane, type the code from the text message or authenticator app that you registered and select Verify.
6. On the <sName>-cpoF67-21-ws1 page, click Command Prompt, on the Access local resources pane, clear the Printer checkbox, and click Allow.
7. When prompted, in the Enter your credentials, in the User name textbox, type the user principal name of cpoF67-User2 and its password.
8. Verify that the Command Prompt Remote App was launched successfully. Type whoami and press the Enter key. Now type hostname and press the Enter key. Take your screenshot. Screenshot must show your Odl_user account, the Command Prompt Remote App launched as cpoF67-User2 with the whoami and hostname output
9. In the Command Prompt Remote App window, at the command prompt, type logoff and press the Enter key.
10. Back on the <sName>-cpoF67-21-ws1 page, in the upper right corner, click cpoF67-User2, in the dropdown menu, click Sign Out, and close the InPrivate web browser window.

Minimum 2-3 sentences each — original thinking, your own words!

1. Why is assigning a Microsoft Entra Premium P2 license necessary before configuring Conditional Access policies, and what limitations would you face without it?
2. In this lab, Multi-Factor Authentication (MFA) was enforced for Azure Virtual Desktop access. How does MFA improve security specifically in a remote desktop environment, and what types of attacks does it help prevent?
3. During testing, you verified that MFA was triggered when accessing the AVD web client. If MFA did not trigger as expected, what are two possible misconfigurations you would investigate, and why?
4. Lab Reflection: Reflect on your experience implementing Conditional Access for Azure Virtual Desktop. How did the combination of MFA, licensing, and policy configuration change your understanding of securing remote access environments, and what challenges or insights did you encounter during the setup and testing process?

Screenshots you attach above and your Task 6 answers appear here. This is exactly what prints/exports as your PDF.

1. All attached screenshots must be high quality, with your Odl_user account clearly visible.
2. A brief explanation added for each screenshot.
3. Export with Print / Save as PDF and upload it to the Blackboard lab submission page.