Implement and manage user identities
20-25%of exam
Implement authentication and access management
25-30%of exam
Plan and implement workload identities
20-25%of exam
Plan and automate identity governance
20-25%of exam
Quick Facts
- Exam
- SC-300
- Level
- Associate
- Exam time
- 100 minutes
- Passing score
- 700 scaled out of 1,000
- Exact question count
- Not published
- Booking
- Pearson VUE
- Renewal
- Free annual online assessment
- English blueprint
- October 28, 2026
Hybrid Authentication
Hash in Entra, pass to AD, federate outward
PHS uses cloud validationPTA uses AD validationAD FS validates through federation
Entra Roles vs Azure RBAC
Entra roles
- Directory objects and settings
- Administrative unit scope where supported
Azure RBAC
- Azure resource permissions
- Subscription or resource scope
Match the object being administered
User Identity Picker
- Delegate admin for one division→Administrative unit(Assign scoped Entra role)
- Membership follows user attributes→Dynamic membership group
- Invite a supplier to apps→B2B collaboration
- Trust partner's existing MFA→Inbound cross-tenant trust
- Automate same-company tenant provisioning→Cross-tenant synchronization
- Validate passwords in the cloud→Password hash synchronization
- Validate passwords against on-premises AD→Pass-through authentication
Tenant Administration
- Built-in Entra role
- Microsoft-defined directory permissions
- Custom Entra role
- Selected directory permissions
- Administrative unit
- Limits supported directory role scope
- Azure RBAC
- Authorizes Azure resource actions
- Custom domain
- Verify ownership with DNS record
- Company branding
- Customizes sign-in appearance
Password Hash Sync vs Pass-Through
Password hash sync
- Entra validates the password
- Synced hash derivative
Pass-through authentication
- On-premises AD validates the password
- Depends on healthy agents
Locate the password validation step
Users, Groups and Devices
- Security group
- Grants access to resources
- Microsoft 365 group
- Shared collaboration resources
- Dynamic membership
- Evaluates attribute rules
- Group-based licensing
- Assigns licenses through group membership
- Custom security attributes
- Business-defined key-value pairs
- Entra registered device
- Common for personal devices
- Entra joined device
- Joined directly to Entra ID
- Entra hybrid joined device
- Joined to AD and Entra
External Identities
- B2B collaboration
- Partner signs in with home identity
- External collaboration settings
- Guest invites and directory visibility
- Inbound cross-tenant access
- External users accessing your resources
- Outbound cross-tenant access
- Your users accessing external resources
- Inbound trust
- Accept partner MFA or device claims
- Cross-tenant synchronization
- Automates B2B user lifecycle
- SAML or WS-Fed federation
- Trusts partner identity provider
Hybrid Identity
- Entra Connect Sync
- On-premises synchronization engine
- Entra Cloud Sync
- Cloud orchestration with provisioning agents
- Password hash synchronization (PHS)
- Entra validates against synced hash
- Pass-through authentication (PTA)
- AD validates password via agent
- AD FS federation
- Federation service authenticates users
- Seamless SSO
- Automatic sign-in on corporate network
- Staged rollout
- Pilot cloud authentication during migration
- Entra Connect Health
- Monitors hybrid identity infrastructure
Conditional Access Sequence
Scope, signal, grant, session
Scope selects users and resourcesSignals include risk and locationGrant sets entry requirementsSession limits ongoing access
Grant vs Session Controls
Grant controls
- Block or grant access
- Require MFA or compliant device
Session controls
- Shape granted access
- Set sign-in frequency
Decide access, then constrain use
Risk and Access Picker
- Bootstrap a new passkey→Temporary Access Pass
- Require phishing-resistant sign-in→Authentication strength
- Use Kerberos with Azure Files→Microsoft Entra Kerberos
- Test a hypothetical sign-in→Conditional Access What If
- Observe real sign-ins before enforcement→Report-only
- Protect a specific directory permission→Protected action(Attach authentication context)
- Respond to a suspicious sign-in→Sign-in risk policy
- Automate remediation for risky accounts→User risk policy
- Reach internal non-web resources→Entra Private Access
- Filter public web traffic→Entra Internet Access
Authentication Methods
- Authentication methods policy
- Enables methods for targeted users
- Authentication strength
- Requires approved method combinations
- Passkeys (FIDO2)
- Phishing-resistant passwordless sign-in
- Windows Hello for Business
- Device-bound PIN or biometric
- Certificate-based authentication
- Sign in with X.509 certificates
- Microsoft Authenticator
- MFA or passwordless phone sign-in
- Temporary Access Pass (TAP)
- Time-limited passwordless onboarding code
- Entra Kerberos
- Kerberos tickets for supported resources
Sign-In Risk vs User Risk
Sign-in risk
- Suspicion about this attempt
- Strong authentication can remediate
User risk
- Suspicion about the identity
- Remediation depends on credential type
Scope the risk before remediation
Credential Recovery
- Self-service password reset (SSPR)
- Users reset their own passwords
- Password writeback
- Writes cloud resets to AD DS
- Password protection
- Screens new passwords for banned terms
- Custom banned list
- Adds organization-specific weak terms
- Security defaults
- Preconfigured tenant-wide identity protections
- MFA registration campaign
- Prompts passkey or Authenticator registration
Conditional Access
- Assignments
- Scope identities and target resources
- Conditions
- Risk, platform, network, client signals
- Grant controls
- Block access or require safeguards
- Session controls
- Constrain an allowed session
- Sign-in frequency
- Controls when reauthentication is required
- Persistent browser session
- Controls sign-in after browser closes
- Continuous access evaluation (CAE)
- Near-real-time response to supported events
- Authentication context
- Targets sensitive resources or actions
- Protected actions
- Apply context to specific permissions
- Report-only
- Logs policy outcomes without enforcement
- What If
- Simulates a specified sign-in
Identity Risk
- Sign-in risk
- Likelihood this sign-in is illegitimate
- User risk
- Likelihood the account is compromised
- Entra ID Protection
- Detects and reports identity risk
- Sign-in risk remediation
- Require strong authentication
- User risk remediation
- Secure reset or passwordless reauthentication
- Risky workload identity
- Investigate affected application or principal
- Account compromise response
- Disable account and revoke sessions
Global Secure Access
- Global Secure Access
- Umbrella for Private and Internet Access
- Entra Private Access
- Identity-aware access to private resources
- Entra Internet Access
- Secure web gateway for internet traffic
- Microsoft traffic profile
- Forwards supported Microsoft service traffic
- Global Secure Access client
- Acquires endpoint traffic for forwarding
App Identity and Consent
Register, instantiate, authorize
Registration defines applicationService principal represents tenant instanceConsent grants API access
Application Object vs Service Principal
Application object
- Defined in home tenant
- Blueprint for tenant app identities
Service principal
- Local identity for app access
- Tenant permissions and assignments
Configure the app or its instance
Workload Identity Picker
- Identity follows Azure resource lifecycle→System-assigned managed identity
- Multiple Azure resources share identity→User-assigned managed identity
- External pipeline has trusted OIDC→Workload identity federation
- Scheduled API job runs unattended→Application permissions
- API call represents signed-in user→Delegated permissions
- Publish an internal web app→Entra Application Proxy
- Block downloads in monitored sessions→Defender session policy
App Objects and Permissions
- Application object
- App definition in home tenant
- Service principal
- App identity in a tenant
- App registration
- Configures credentials and redirect URIs
- Delegated permission
- API access on user's behalf
- Application permission
- API access as app itself
- App roles
- App-defined authorization values
- Delegated scopes claim
- scp lists granted scopes
- App roles claim
- roles lists assigned app roles
- Admin consent workflow
- Routes user requests for review
Delegated vs Application Permissions
Delegated permissions
- Signed-in user context
- Bounded by user's own access
Application permissions
- App-only context
- Privileged consent required
Identify who the call represents
Managed Identities
- Managed identity
- Azure manages credentials
- System-assigned identity
- Shares one resource's lifecycle
- User-assigned identity
- Independent and reusable Azure identity
- Managed identity authorization
- Grant permissions on target resource
- Workload identity federation
- Trusts external tokens without secrets
- Group managed service account
- AD DS account for services
- Workload Conditional Access
- Directly targets eligible service principals
System-Assigned vs User-Assigned Identity
System-assigned
- One Azure resource
- Deleted with parent resource
User-assigned
- Standalone Azure resource
- Can serve multiple Azure resources
Match ownership and lifecycle
Enterprise App Integration
- Enterprise applications
- Manage tenant-local app access
- SAML SSO
- XML assertion for sign-in
- OpenID Connect
- ID token for sign-in
- SCIM provisioning
- Automates app account lifecycle
- Entra Application Proxy
- Publishes on-premises web apps
- Private network connector
- Initiates outbound connections
- Application collections
- Group apps in My Apps
- Application Administrator
- Can manage Application Proxy
SSO vs App Provisioning
Single sign-on
- Authenticates the user
- SAML or OpenID Connect
App provisioning
- Creates or updates accounts
- SCIM for supported apps
Match sign-in or account lifecycle
Defender for Cloud Apps
- Cloud Discovery
- Finds cloud apps from traffic
- Cloud app catalog
- Rates apps by risk factors
- App connectors
- API integration with supported apps
- App-enforced restrictions
- Supported app applies session limits
- Conditional Access App Control
- Enforces Defender session policies
- Defender session policy
- Controls actions such as downloads
- App governance
- Monitors and governs OAuth apps
Governance Lifecycle
Request, review, elevate
Package grants bundled accessReview checks continued needPIM activates eligible privilege
Eligible vs Active PIM Assignments
Eligible
- Activation before role use
- May require approval or MFA
Active
- Role usable during assignment
- Can be time-bound or permanent
Assignment type and duration differ
Governance Picker
- Request bundled project access→Access package
- Set project access expiration→Package assignment policy
- Require users to accept terms→Terms of use
- Recertify existing group access→Access review
- Activate an admin role temporarily→PIM eligible role assignment
- Activate temporary group ownership→PIM for Groups
Entitlements and Reviews
- Entitlement management
- Automates requests and access lifecycle
- Catalog
- Contains resources and access packages
- Access package
- Bundles resource roles
- Assignment policy
- Sets eligibility, approval and expiration
- Connected organization
- Defines partner identities for requests
- Terms of use
- Requires acceptance through Conditional Access
- Access review
- Reassesses existing access
- Review results
- Apply manually or automatically
Access Packages vs Access Reviews
Access packages
- Bundle roles for request
- Control approval and expiration
Access reviews
- Evaluate current assignments
- Reviewers confirm or deny access
Request access or reassess it
Identity Logs Picker
- Why was sign-in blocked?→Sign-in logs
- Who changed group membership?→Audit logs
- Why did app provisioning fail?→Provisioning logs
- Query exported logs across time→Log Analytics
- Stream identity logs to SIEM→Azure Event Hubs
Privileged Identity Management
- Eligible assignment
- Activate before using privilege
- Active assignment
- Privilege usable without activation
- Assignment duration
- Permanent or time-bound
- Activation requirements
- MFA, justification or approval
- PIM for Entra roles
- Governs directory role activation
- PIM for Azure resources
- Governs Azure RBAC activation
- PIM for Groups
- Activates group membership or ownership
- Emergency access accounts
- Permanent active Global Administrator
- Emergency account setup
- At least two cloud-only accounts
- PIM audit history
- Tracks role activity and changes
Identity Monitoring
- Sign-in logs
- Authentication and policy outcomes
- Audit logs
- Directory changes and actors
- Provisioning logs
- Provisioning operations and errors
- Log Analytics workspace
- Queries exported logs with KQL
- Azure Event Hubs
- Streams logs to downstream tools
- Azure Storage
- Archives exported logs
- Entra workbooks
- Visualize identity trends
- Identity Secure Score
- Measures alignment with security recommendations
Common Traps
Cross-tenant settings
Access settings govern trust ≠ Synchronization provisions users
Password reset
Writeback updates AD DS passwords ≠ Password hash sync feeds Entra
Conditional Access testing
What If simulates inputs ≠ Report-only records actual sign-ins
Authentication policy
Methods policy enables methods ≠ Strength policy requires combinations
Managed identity permissions
Identity obtains a token ≠ Target grants resource access
Private application access
Application Proxy publishes web apps ≠ Private Access supports non-web traffic
Session restriction owner
App enforces its own restrictions ≠ Defender controls monitored app sessions
PIM and emergency access
Just-in-time admin activates privilege ≠ Emergency Global Admin stays active
Identity log selection
Sign-in logs track authentication ≠ Audit logs track directory changes
Last Minute
- 1.Administrative units scope directory delegation
- 2.Inbound trust accepts partner MFA
- 3.Pass-through authentication validates against AD
- 4.Temporary Access Pass bootstraps passkeys
- 5.Report-only logs live policy impact
- 6.Sign-in risk concerns one attempt
- 7.Private Access reaches internal resources
- 8.User-assigned managed identities are reusable
- 9.Delegated permissions require user context
- 10.Access reviews recertify existing access
- 11.Eligible PIM assignments require activation
- 12.Provisioning logs show sync failures
Practice Questions200 questionsStudy Guide44 topicsCheat Sheet123 factsFlashcards50 cardsGames20 termsFeedVideos1 videoBlogs1 blog
Third-party resources · We may earn a commission from purchases.
MICROSOFT CERTIFIED - IDENTITY AND ACCESS ADMINISTRATOR ASSOCIATE, QUESTION BANK STUDY GUIDE, EXAM CODE SC-300, 8 FULL-LENGTH PRACTICE TESTS, 400 ... ALERTS, CONCISE AND CLEAR EXPLANATIONS
By M, Mr Anand
$26.99 · 
Learning path on Pluralsight
Take courses on UdemySame family resources
Explore More Microsoft Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Course PlaylistMore From This Family
Videos and articles for deeper review.
VideoFREE DP-600 Exam Guide 2026: Pass Microsoft Fabric Analytics Engineer (Direct Lake, DAX, Semantic Models)VideoFREE MD-102 Exam Guide 2026: Pass Microsoft Endpoint Administrator (Intune, Autopilot, Windows 11)VideoFREE MS-102 Exam Guide 2026: Pass Microsoft 365 Administrator (Entra, Defender XDR, Purview)VideoIs PL-300 Worth It in 2026? Power BI Salary & Career RealityArticleMS-900 Retired 2026: FREE Guide + AB-900 Pivot17 min readArticlePL-900 Exam Guide 2026: Current Outline and Free Prep19 min readArticlePL-200 Exam Guide 2026: Skills, Retirement, and Renewal12 min readArticlePL-400 Exam Guide 2026: Skills, Format, and Renewal12 min read