Free SC-300 Exam Flashcards
Memorize 50 essential terms and definitions for the Microsoft Certified: Identity and Access Administrator Associate (SC-300). See the term, recall the definition, then flip to check yourself.
How can you delegate password resets for non-admin library staff to a university helpdesk team?
Place library staff in a Microsoft Entra administrative unit and assign the team's Helpdesk Administrators at that scope. They can then reset eligible users' passwords within the unit.
Filter by Topic
Jump to Card
About These SC-300 Flashcards
These 50 flashcards are designed to help you memorize key terms and definitions for the Microsoft Certified: Identity and Access Administrator Associate (SC-300). Each card shows a term on the front and its definition on the back—the classic flashcard format for vocabulary memorization. Use these alongside our practice questions to build both recall and comprehension.
Topics Covered
Complete Flashcard Reference
Review every term in this set. Open any term to reveal its definition.
How can you delegate password resets for non-admin library staff to a university helpdesk team?
Place library staff in a Microsoft Entra administrative unit and assign the team's Helpdesk Administrators at that scope. They can then reset eligible users' passwords within the unit.
Which role system governs directory users, and which governs Azure virtual machines?
Microsoft Entra roles govern directory tasks such as managing users and groups. Azure role-based access control (Azure RBAC) governs access to Azure resources such as virtual machines.
How do you prove ownership of a custom domain in Microsoft Entra ID?
Publish the TXT or MX verification record that Microsoft Entra provides in the domain's DNS, then verify the domain in Microsoft Entra ID.
What keeps group membership aligned with changes to users' department attributes?
A dynamic membership rule evaluates the department attribute. Microsoft Entra adds users when they match the rule and removes them when they stop matching.
Which Entra attributes can supply a user's project code to an Azure Storage access condition?
Custom security attributes store organization-defined key-value pairs on objects such as users. An Azure attribute-based access control condition can evaluate the project code when authorizing access to blobs.
Which device identity fits a personal Windows PC whose owner keeps their usual local sign-in?
Microsoft Entra registered. The user signs in to Windows with their existing credentials and adds a work account for organizational access. Microsoft Entra joined Windows devices support signing in to Windows with an organizational account.
How do you automate Microsoft 365 license assignments based on group membership?
Assign the product license to the group in the Microsoft 365 admin center. Group members inherit the assignment. When a member leaves, group-based licensing removes that group's assignment.
How can a resource tenant accept MFA already performed in a partner's Microsoft Entra tenant?
Enable inbound MFA trust for that partner in cross-tenant access settings. The resource tenant can then use the partner's MFA claim to satisfy its own Conditional Access MFA requirement.
What does cross-tenant synchronization automate for B2B collaboration?
It provisions, updates, and deprovisions in-scope B2B users from a source Microsoft Entra tenant into a target tenant. Each synchronization configuration runs in one direction.
Which hybrid sync option can use lightweight agents in disconnected Active Directory forests?
Microsoft Entra Cloud Sync. Agents connect the separate forests to the cloud provisioning service, where you configure synchronization to Microsoft Entra ID.
Where is a cloud sign-in password checked when you use password hash synchronization?
Microsoft Entra ID validates the sign-in in the cloud using a derived hash synchronized from on-premises Active Directory. The cloud check can continue during an on-premises outage.
Where is a cloud sign-in password checked when you use pass-through authentication?
An on-premises authentication agent validates the password against Active Directory. Cloud sign-in by this method depends on an available agent that can reach a domain controller.
What can a new user use to register a passkey before they have a strong sign-in method?
A Temporary Access Pass (TAP) is a time-limited code that lets the user sign in and register a passwordless method. You can configure the pass for one sign-in or repeated use before expiration.
Which phishing-resistant passwordless method can use a hardware security key?
A FIDO2 passkey. It uses a public-key credential tied to the sign-in site, and the user unlocks the key with a local gesture such as a PIN or biometric.
Which Microsoft Entra authentication method directly accepts users' X.509 certificates?
Microsoft Entra certificate-based authentication (CBA). Configure trusted certificate authorities and rules that map certificates to Microsoft Entra user accounts.
How can a hybrid user's cloud self-service password reset also update on-premises Active Directory?
Enable password writeback for self-service password reset (SSPR). Microsoft Entra Connect Sync or Cloud Sync writes the reset back to Active Directory Domain Services.
Which capability lets hybrid users get Kerberos tickets for Azure Files through Microsoft Entra?
Microsoft Entra Kerberos. It can issue Kerberos tickets for supported Azure Files SMB shares so hybrid users can access those shares with their existing identities.
Which Conditional Access mode records a policy's impact before you enforce it?
Report-only mode evaluates the policy at sign-in and records the result in sign-in logs. Use those results to check who would be affected before turning the policy on.
Which Conditional Access control lets you require phishing-resistant MFA for an app?
Require authentication strength. Select the phishing-resistant MFA strength to limit access to users who authenticate with an allowed method or combination.
How can disabling an account cut off access before its existing token expires?
Continuous access evaluation (CAE) lets supported services respond to critical events such as account disablement. A CAE-capable service can reject an existing access token when it receives the event.
How can you require phishing-resistant MFA specifically when admins edit Conditional Access policies?
Configure a protected action. Associate the relevant Microsoft Entra permission with an authentication context, then target that context with a Conditional Access policy requiring phishing-resistant MFA.
What does a Conditional Access authentication context let a supported app protect?
It can trigger a policy for a specific sensitive operation or resource inside the app, such as a protected SharePoint site. The policy applies when the app requests that context.
What is the difference between sign-in risk and user risk?
Sign-in risk estimates whether a particular sign-in attempt is unauthorized. User risk estimates whether the identity itself is compromised and can draw on multiple detections.
Where do you investigate a service principal flagged for suspicious activity?
Open Risky workload identities in Microsoft Entra ID Protection. Review the detections and service principal sign-ins before deciding whether to confirm compromise, dismiss the risk, or disable the service principal.
Which Global Secure Access service handles private apps, and which handles public web traffic?
Microsoft Entra Private Access provides access to private resources. Microsoft Entra Internet Access helps secure access to public internet and SaaS destinations.
Which Global Secure Access traffic profile forwards traffic for Exchange Online and SharePoint Online?
The Microsoft traffic forwarding profile. It routes traffic for supported Microsoft 365 workloads through Global Secure Access.
Which managed identity can multiple Azure resources share and keep after a resource is deleted?
A user-assigned managed identity. You create it as a separate Azure resource and can attach it to multiple supported services. A system-assigned identity follows the lifecycle of its host resource.
Which Azure role lets a workload's managed identity read secrets from an RBAC-enabled Key Vault?
Assign Key Vault Secrets User to the managed identity at the appropriate scope. It grants permission to read secret contents through the Key Vault data plane.
What is the difference between an app registration's application object and its service principal?
The application object holds the app's definition in its home tenant. The service principal represents the app in a particular tenant, where administrators can manage its assignments and permissions.
Which API permission type fits an unattended job calling Microsoft Graph?
Application permissions let a job call Microsoft Graph as its own identity after the required admin consent. Delegated permissions let an app act on behalf of a signed-in user.
What does the redirect URI in an app registration control?
It specifies where Microsoft Entra can send the browser after authorization. The redirect URI in the request must match a registered URI for the app to receive the response.
How can an app receive a user's Approver role in a token?
Define an app role on the app registration and assign it to the user or an applicable group in the enterprise app. The app can then use the token's roles claim to authorize actions.
What lets users request access to an app whose permissions require admin consent?
The admin consent workflow routes requests to designated reviewers. A reviewer needs the appropriate consent permission to approve the request.
Which enterprise app setting can limit SAML sign-in to assigned users and groups?
Set Assignment required to Yes and assign the approved users or groups to the enterprise app. Global Administrators can still sign in regardless of this setting.
How can you publish an internal web app for remote access without opening inbound firewall ports?
Use Microsoft Entra Application Proxy. Its private network connector opens outbound connections to the cloud service, and Microsoft Entra preauthentication lets you apply Conditional Access before forwarding requests.
Which protocol manages SaaS accounts over time when SAML already handles sign-in?
SCIM supports provisioning and deprovisioning users in compatible SaaS apps as their access needs change. SAML handles single sign-on.
Which Defender for Cloud Apps capability identifies unapproved SaaS use from network traffic?
Cloud Discovery compares traffic logs with its cloud app catalog. This shows which cloud apps users access and helps you assess their risk.
Which Defender for Cloud Apps control can block downloads during a supported browser session?
Conditional Access App Control lets Defender for Cloud Apps enforce real-time session controls. A session policy can block sensitive file downloads from unmanaged devices.
What does an entitlement management catalog organize?
A catalog groups related resources and access packages. Catalog owners can manage the resources available for packages in that catalog.
What bundles group memberships, app roles, and SharePoint access into one request?
An access package bundles resource roles from a catalog. When a package assignment is granted, entitlement management assigns the included access.
Where do you configure who can request an access package and when assignments expire?
Use an access package assignment policy. It defines the eligible requesters and can specify approval requirements and the assignment lifetime.
How do you make an access package requestable by people from a specific partner organization?
Add the partner as a connected organization, then choose Specific connected organizations in the access package policy for external users. Select the partner to allow its users to request access.
How do you require users to accept your usage terms before opening a protected app?
Create a Microsoft Entra terms of use policy and require it as a Conditional Access grant control for the app. Users must accept the terms to satisfy that control.
What can regularly ask app owners whether current users still need access?
Create a recurring Microsoft Entra access review for the enterprise app. Select the app owners by name as reviewers and set the review recurrence.
When can someone with an eligible PIM role assignment use the role?
After activating it in Privileged Identity Management (PIM) and meeting any configured requirements, such as approval or MFA. An active assignment already grants the role for its assigned duration.
What does PIM for Groups let users activate just in time?
Membership or ownership of a managed Microsoft Entra security group or Microsoft 365 group. Each can have its own activation requirements and maximum duration.
Why does Microsoft recommend cloud-only emergency access accounts?
They can restore tenant administration during an on-premises identity outage or admin lockout. Microsoft recommends at least two cloud-only accounts on the tenant's onmicrosoft.com domain with permanently active Global Administrator assignments.
Which Entra log shows who changed a Conditional Access policy?
Use the audit logs for directory changes such as policy edits. Sign-in logs show policy evaluation during sign-in, and provisioning logs track the provisioning service's changes.
Where do you send Microsoft Entra activity logs to query them with KQL?
Use diagnostic settings to send the required log categories to a Log Analytics workspace. Run Kusto Query Language (KQL) queries in that workspace.
What does Microsoft Entra Identity Secure Score measure?
It measures how closely your identity configuration aligns with Microsoft's security recommendations. Use its improvement actions to identify changes that can improve your identity security posture.
Frequently Asked Questions
How long is SC-300, and how many questions are on it?
Microsoft gives you 100 minutes of assessment time. The exam is proctored and may include interactive components. Microsoft reports a typical range of 40–60 questions across most of its certification exams and leaves the SC-300 item count unpublished.
What is the SC-300 passing score?
You need a scaled score of at least 700 on Microsoft's 1–1,000 scale. The raw points needed for that scaled score can vary. Microsoft leaves the SC-300 pass rate unpublished.
What does the current SC-300 outline cover?
The skills-at-a-glance table for the English outline effective October 28, 2026 lists user identities (20–25%), authentication and access management (25–30%), workload identities (20–25%), and identity governance (20–25%).
Can I register for SC-300 on my own?
Yes. Use the certification page to schedule with Pearson VUE. Microsoft recommends a personal Microsoft account and familiarity with Azure, Microsoft 365, Active Directory Domain Services, PowerShell, and Kusto Query Language.
When can I retake SC-300 after a failed attempt?
Wait 24 hours after your first failure and 14 days between later attempts. Microsoft allows up to five attempts within 12 months of your first attempt. After five failures, you can try again 12 months after the first attempt.
How do I renew the Identity and Access Administrator Associate certification?
The credential renews on a 12-month cycle. During the six months before expiration, you can take a free online renewal assessment on Microsoft Learn. Passing before expiration extends the credential by one year from its expiration date.
Explore More Microsoft Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
Course PlaylistMore From This Family
Videos and articles for deeper review.