Microsoft Cloud for Windows Server Administrators

Most IT teams still run on-premises Active Directory and Group Policy, but identity, device management, and access control are moving to the Microsoft cloud. When administrators lack hybrid skills, cloud adoption stalls or relies on outside help. IT teams complete this training to manage AD and Microsoft Entra ID side by side and plan a safe move to cloud-first identity.

Role fit: Built for Windows Server administrators and help desk staff with basic Windows admin experience who are moving into server, cloud, or hybrid roles. It is rated Beginner, so it suits upskilling a junior team or cross-training on-prem admins.

Time investment: About 9 hours per learner, delivered as 10 skills of roughly 50–65 minutes each. Most teams can finish it in two to three weeks alongside daily work.

Risk and compliance: The course covers Entra Connect sync, device registration and hybrid join, Microsoft Intune device management, passkeys, and Conditional Access based on location, device state, and sign-in risk. Your team learns how these controls tighten access without disrupting users.

Change-management notes: The instructor recommends a staged rollout:

• Use device registration as a first step into Entra ID.
• Pilot passkeys with a small group before expanding.
• Weigh Group Policy dependencies before changing the source of authority.

Lab setup: Learners need access to an Azure tenant to follow the demos. Plan tenant access and permissions before scheduling lab work.

Validation questions throughout the course help Team Leads confirm readiness before learners apply changes in production.

IT teams complete this training to move Windows Server administrators from on-premises-only thinking to confident hybrid operations, using the same multi-site scenario (Phoenix, Las Vegas, Albuquerque offices) that many organizations already run.

• Hybrid identity without disruption: Your team learns to prepare custom domains and update user principal names (UPNs) in Active Directory. They then install Microsoft Entra Connect Sync to bring on-premises identities into Entra ID. Afterward, they validate device join state during migration, which reduces sign-in issues.
• Remote device control at scale: Administrators practice registering and hybrid-joining devices and enrolling domain-joined machines into Intune through Group Policy. They also run remote actions like restarts, diagnostics collection, fresh start, and antivirus scans, which means fewer desk-side visits.
• Stronger access security: Teams roll out passkeys to a pilot group first, then build Conditional Access policies based on location, device state, and user risk. The result is phishing-resistant sign-ins and fewer risky logons.
• One view across environments: The Azure Arc lessons show how administrators can approach management across on-premises Windows servers, Linux systems, and systems in other clouds without juggling as many separate tools.

The course closes with practical decision-making on when to keep Active Directory on-premises and when to shift the source of authority to Entra ID. This helps Team Leads plan migrations around real dependencies like Group Policy objects.

Knowledge

• How on-premises, colocation, and cloud models differ, including operational vs. capital expense tradeoffs and where IaaS, PaaS, and SaaS fit in the Microsoft Cloud ecosystem
• How Active Directory and Entra ID compare for users, groups, and organizational units, and where Entra ID groups add value for collaboration
• The differences between Entra registered, Entra joined, and Entra hybrid-joined devices, and when each fits a transition plan
• What Intune is and is not, including licensing decisions based on job role, data handled, and security exposure
• How Azure Arc extends Azure management to on-premises Windows and Linux servers and other cloud platforms
• The considerations for changing the source of authority from Active Directory to Entra ID, such as dependence on on-premises Group Policy

Ability

• Create an Azure account, navigate the portal, and deploy a VM with tags that separate billing by department
• Manage Global Admin and user accounts, secure them with passkeys or physical security keys, and review AI-assisted user-creation scripts before running them
• Configure a custom domain, align on-premises UPNs, and install Microsoft Entra Connect Sync to synchronize AD with Entra ID
• Register and hybrid-join devices, and verify join state with dsregcmd /status
• Use Intune to restart, run diagnostics on, scan, or fresh-start devices, and enroll domain-joined machines through a Group Policy object
• Onboard servers to Azure Arc, and roll out passkey authentication to a pilot group before broader deployment
• Build Conditional Access policies that evaluate location, device state, and sign-in or user risk