If you want to move into Identity and Access Management (IAM), you don't need to start with an enormous home lab.
I'd build three focused projects that demonstrate different parts of identity work:
- Control who can access a resource.
- Connect an application to a sign-in system.
- Change access when an employee joins, transfers, or leaves.
Each project should solve a believable business problem and produce evidence you can show in an interview.
The goal isn't to collect screenshots. It's to understand how the system behaves—and prove you tested it.
Lab 1: Show why one employee gets access and another doesn't
Business scenario: Two employees need different levels of access to the same shared folder.
In an isolated Windows lab, create:
- Two fictional user accounts.
- A security group for employees who need access.
- One shared test folder or file.
Give the group the required permission. Add User A to the group and leave User B out.
Now test using their ordinary accounts, not an administrator account.
| Test | Expected result |
|---|---|
| User A opens the folder | Allowed |
| User B opens the folder | Denied |
| User A is removed from the group, then retested appropriately | Access is revoked |
Remember that group changes and existing sessions or tokens may affect when a permission change takes effect. Record the actual conditions of your test instead of pretending every change is instantaneous.
What to publish: A simple access matrix, a diagram of the account/group/resource relationship, and screenshots or logs demonstrating the results.
Microsoft documents the role of Active Directory security groups in assigning access to shared resources.
Lab 2: Configure single sign-on and troubleshoot a failure
Business scenario: An employee needs to sign in to a test business application using an identity provider.
Choose a documented application and identity-provider combination you can operate safely.
Your project should show:
- The application and identity provider are configured to work together.
- A test user can sign in successfully.
- You can explain the basic authentication flow.
- You can introduce and fix one reversible configuration error.
For example, depending on the integration, an incorrect redirect URI or other mismatch may cause an authentication failure.
Don't stop after taking a screenshot of the application dashboard.
Document the error, where you looked for evidence, the correction, and a successful retest. That's the part that demonstrates troubleshooting.
Lab 3: Manage an employee's access through a job change
Business scenario: A fictional employee joins the company, transfers from sales to finance, then leaves.
Create an access table for each stage:
- Joiner: Which accounts and permissions are approved for sales?
- Mover: Which sales entitlements should be removed, and which finance permissions should be added?
- Leaver: What accounts, application assignments, and sessions need attention?
You can model the workflow manually before using automation or paid governance features.
The technical steps matter, but so do the business decisions: who approves access, who owns the application, and how you verify a change.
Don't claim that disabling one account automatically terminates every existing session in every connected service.
What to publish: A before-and-after permission table, a brief workflow diagram, and the results of your access checks.
Make each project understandable in 30 seconds
Give each project a short README with:
- Problem: What employee or business need are you addressing?
- Setup: What systems and fictional accounts did you use?
- Test: What should work, and what should fail?
- Result: What actually happened?
- Limitation: What didn't this small lab test?
Exclude passwords, tokens, employer details, and sensitive system information from your public portfolio.
You can reuse the same lab infrastructure for all three projects. What should change is the skill each project demonstrates.
Choose the lab that matches a job you want
You don't need to finish all three before applying anywhere.
If the roles you're targeting emphasize directory access, begin with Lab 1. If they emphasize federation and troubleshooting, Lab 2 may be more relevant. Governance-focused roles could make Lab 3 a better first choice.
I mapped these three projects to IAM roles and a 90-day career plan in The Six-Figure IAM Career Playbook. It's a $9 guide for deciding what to build and how to turn it into credible evidence.
Finish one project that answers a real hiring question before expanding your home lab.