NORTHSTAR SERVICES / IAM-711IDENTITY OPERATIONS INVESTIGATION
The impossible regional permission
A regional administrator has unexpected tenant-wide privileges, and a contractor is unable to redeem an invitation.
STEP 1 OF 4
PRACTICE / MODULE 022 / MICROSOFT ENTRA
The admin has permission.
What does the evidence say?
Trace effective directory permissions, external-user lifecycle, Cloud Sync vs Connect Sync, password authentication, Windows Hello and Kerberos failures across two original Northstar cases.
03 / APPLY THE DECISIONS
Trace the source. Inspect the role. Prove the ticket.
Two Northstar tickets investigate an overprivileged regional admin with external guest issues and a hybrid device with cloud sign-in but failed Kerberos access.
Windows Hello & Kerberos deployment clinic
Two independent four-stage investigations. Select a supported rollout, prove the identity-to-resource ticket chain, and plan safe recovery. This is a simulation—not a connected Microsoft tenant.
0 of 2 investigation tracks complete · Browser-session only · Original Practice 022 progress stays unchangedIAM-902 / HYBRID IDENTITY
Deploy Windows Hello for Business to a small hybrid pilot.
Northstar needs a passwordless Windows sign-in and on-prem file-share access for synchronized users. Certificate authentication is not a requirement.
CHECKPOINT 1 / 4
Select the deployment model
Available evidence
Entra-joined Windows 11 laptops, synchronized AD DS identities, supported writable domain controllers, and a normal on-prem SMB share.
LEARN → PRACTICE → LAB → TROUBLESHOOT
Review the Learn guide →Prove the scope. Validate the sync. Restore secure access.
Revisit the identity operations guide or the full SC-300 objective map for deeper practice.