Course overview

The course follows a structured approach that combines theory, demos, and hands-on labs, similar to advanced training programs like those from Altered Security. Each topic is introduced with a short explanation using slides or video, followed by a live demonstration of the technique, and then directly applied in a lab environment. This format keeps the training practical and engaging.

We start with identity basics and OAuth 2, then move step by step into hybrid trust paths and deep token internals. Each new concept is tested right away in a lab portal that tracks your flags and progress. The syllabus for the training can be found here.

The trainer, Dirk-Jan Mollema, explains every topic clearly and answers all questions. His knowledge of Entra ID is outstanding. The venue, New Babylon in The Hague, was easy for me to reach and the facilities were good, although noise from the other rooms was sometimes distracting. That issue was outside Outsider Security’s control.

Key lessons that stood out for me

I already had basic to intermediate knowledge of Entra ID, so what caught my attention may differ from what stands out for you. The points I found most interesting were:

✅ How attackers can bypass device compliance checks and bypass Conditional Access
✅ The misconfigurations that can appear in a hybrid Active Directory to Entra ID setup and the attack paths they open (lateral movement)
✅ Gaining in-depth experience with Roadtools to interact with Entra ID from an attacker’s perspective, especially for enumeration and token-based access workflows

 

Classroom dynamics and pace

Since I already had some background knowledge of Entra ID and related topics, the pace sometimes felt a bit slow for me. The variation in participants’ experience levels meant the tempo wasn’t always consistent. While I felt the material could have been covered in three days, others may have needed the full four to keep up.

On the plus side we kept access to the lab environment for an extra week, which was perfect for revisiting tricky sections, and Outsider Security even organised an informal drink after the course.

 

Conclusion

The course is aimed at security professionals who already know the basics of Entra ID and other basic application knowledge like how to use REST APIs. Pentesters, red teamers, blue team staff and SOC analysts will all benefit from the realistic attack chains and deeper theory. The overall value is high thanks to strong content, expert instruction and well designed and stable challenges. If you need to sharpen offensive or defensive skills in Entra ID, this training is an excellent choice and I highly recommend it to everyone. Given the depth and quality of the material, it’s more than worth the price.

Finally, a huge shout-out to Dirk-Jan from Outsider Security for developing such an informative course!