1.3 Skills Measured & Study Map
Key Takeaways
- As of April 27, 2026, SC-300 measures four domains: user identities 20–25%, authentication and access management 25–30%, workload identities 20–25%, and identity governance 20–25%.
- Authentication and access management is the heaviest domain—prioritize MFA methods, Conditional Access, ID Protection, and Global Secure Access in study time.
- User identities cover tenant settings, roles, users/groups, external identities, and hybrid sync/auth patterns such as Connect Sync, Cloud Sync, PHS, and PTA.
- Workload identities focus on managed identities, service principals, enterprise apps, app registrations, and Defender for Cloud Apps monitoring.
- Identity governance emphasizes entitlement management, access reviews, PIM, and Entra monitoring with logs, workbooks, KQL, and Identity Secure Score.
/practice/azure-sc-300Practice questions with detailed explanations
Skills at a Glance (Effective April 27, 2026)
Microsoft updates SC-300 periodically. This guide follows the skills measured effective as of April 27, 2026 on the official Microsoft Learn study guide. English updates land first; localized exams may lag by about eight weeks. Always re-check the live study guide before you schedule if your date is far out.
| Domain | Weight | Relative priority |
|---|---|---|
| 1. Implement and manage user identities | 20–25% | High |
| 2. Implement authentication and access management | 25–30% | Highest (heaviest) |
| 3. Plan and implement workload identities | 20–25% | High |
| 4. Plan and automate identity governance | 20–25% | High |
All four domains matter. None is optional. The only strategic bias is giving extra hours to Domain 2 because it can reach nearly a third of the exam.
Note: Most questions cover general availability (GA) features. Preview features appear only if they are commonly used. Study GA admin-center behavior and current Microsoft Learn docs first.
Domain 1 — Implement and Manage User Identities (20–25%)
This domain builds the tenant foundation and identity lifecycle.
Configure and manage a Microsoft Entra tenant
- Built-in and custom Microsoft Entra roles; evaluate effective permissions
- Administrative units — when to recommend them and how to configure them
- Domains in Entra ID and Microsoft 365; company branding
- Tenant properties plus user, group, and device settings
Create, configure, and manage Microsoft Entra identities
- Users and groups; custom security attributes
- Bulk operations via admin center and PowerShell
- Device join and registration
- License assign/modify/report
External users and tenants
- External collaboration settings; invite guests (individual/bulk)
- Cross-tenant access settings and cross-tenant synchronization
- External identity providers (including SAML and WS-Fed)
Hybrid identity
- Entra Connect Sync vs Cloud Sync
- Password hash synchronization (PHS), pass-through authentication (PTA), seamless SSO
- Migrate from AD FS to modern auth patterns
- Entra Connect Health
Study focus: Be able to choose PHS vs PTA, explain Cloud Sync fit, design guest collaboration safely, and use administrative units for delegated admin without over-scoping Global Administrator.
Domain 2 — Implement Authentication and Access Management (25–30%)
Heaviest domain. Budget more lab time here than any other single domain.
Microsoft Entra user authentication
- Plan authentication; methods including certificate-based authentication, Temporary Access Pass (TAP), OAuth 2.0 tokens, Microsoft Authenticator, and passkeys (FIDO2)
- Tenant-wide MFA settings; SSPR; Windows Hello for Business
- Disable accounts and revoke sessions
- Microsoft Entra password protection; Entra Kerberos for hybrid identities
Conditional Access
- Plan policies; assignments and controls; test/troubleshoot
- Session management; device-enforced restrictions; continuous access evaluation (CAE)
- Authentication context; protected actions; policies from templates
Microsoft Entra ID Protection
- User risk and sign-in risk via ID Protection or Conditional Access
- MFA registration campaigns
- Investigate/remediate risky users, sign-ins, and risky workload identities
Global Secure Access
- Deploy clients; Private Access; Internet Access; Internet Access for Microsoft 365
Study focus: Build Conditional Access policies from requirements (grant controls, session controls, exclusions for break-glass), map authentication methods to scenarios (TAP for onboarding, FIDO2 for passwordless admins), and interpret risk-based controls without disabling security for convenience.
Domain 3 — Plan and Implement Workload Identities (20–25%)
Non-human identity is a first-class SC-300 topic.
Identities for applications and Azure workloads
- Choose among managed identities, service principals, user accounts, and managed service accounts
- Create managed identities; assign to Azure resources; use them to access other Azure resources
Enterprise application integration
- App-level and tenant-level enterprise app settings
- Entra roles for app administration
- Microsoft Entra Application Proxy for on-premises apps; SaaS integration patterns
- Users/groups/app roles; user and admin consent; application collections
App registrations
- Plan and create registrations; configure authentication; API permissions; app roles
Microsoft Defender for Cloud Apps
- Cloud discovery; connected apps; application-enforced restrictions
- Conditional Access app control; access/session policies; OAuth app policies; cloud app catalog
Study focus: Prefer managed identities over secrets in code; know consent risks; distinguish app registration vs enterprise application objects; use Defender for Cloud Apps where the blueprint requires visibility and session control.
Domain 4 — Plan and Automate Identity Governance (20–25%)
Governance closes the lifecycle loop and is heavily scenario-based.
Entitlement management
- Catalogs; access packages; access requests; terms of use (ToU)
- External user lifecycle; connected organizations
Access reviews
- Plan, create, configure, monitor, and manually respond to review outcomes
Privileged access
- Privileged Identity Management (PIM) for Entra roles and Azure resources
- PIM for Groups; request/approval process; audit history
- Break-glass (emergency access) accounts
Monitor identity activity
- Sign-in, audit, and provisioning logs in the admin center
- Diagnostic settings to Log Analytics, storage, Event Hubs
- KQL in Log Analytics; workbooks and reporting; Identity Secure Score
Study focus: Design access packages for guest projects, schedule access reviews for groups/apps/roles, configure PIM eligible assignments instead of permanent privileged roles, and know which log answers which investigation question.
Weight-Based Study Prioritization
Assume an 100-hour intermediate plan (adjust up if you are new to Entra):
| Domain | Weight mid-point | Suggested share of study time | Hands-on lab emphasis |
|---|---|---|---|
| Authentication & access | ~27.5% | ~30–35 hours | Conditional Access, methods, ID Protection, GSA basics |
| User identities | ~22.5% | ~22–25 hours | Tenant, users/groups, guests, hybrid sync lab |
| Workload identities | ~22.5% | ~20–22 hours | Managed identities, app reg, enterprise apps, MDCA |
| Identity governance | ~22.5% | ~20–22 hours | Access packages, reviews, PIM, logs/KQL |
| Mixed review & timed practice | — | ~10–15 hours | Full-length simulations, weak-area drills |
Recommended sequence
- Tenant + users/groups + roles (Domain 1 foundation)
- Hybrid identity (Domain 1) so later auth scenarios make sense
- Authentication methods + MFA + SSPR (Domain 2)
- Conditional Access + ID Protection (Domain 2 core)
- Global Secure Access overview (Domain 2)
- Managed identities + app registrations + enterprise apps (Domain 3)
- Defender for Cloud Apps controls tied to Conditional Access (Domain 3)
- Entitlement management + access reviews + PIM (Domain 4)
- Logs, workbooks, Secure Score, KQL destinations (Domain 4)
- Mixed timed practice and score-report remediation
Hands-On Lab Minimums
Reading alone is a common fail pattern. Before exam day, you should have personally:
- Created a Conditional Access policy with report-only then enforcement
- Registered at least two authentication methods and tested SSPR
- Invited a guest and constrained cross-tenant settings
- Compared Connect Sync vs Cloud Sync documentation against a lab or diagram you drew
- Created an app registration with API permissions and an app role
- Assigned a managed identity and used it for resource access in a lab
- Built an access package with approval and a short-lived assignment
- Configured a PIM eligible role and completed an activation
- Sent Entra logs to Log Analytics and ran a simple KQL sign-in query
Use a free or trial Entra / Microsoft 365 developer or trial tenant. Never experiment with production break-glass or Conditional Access without a safe exclusion plan.
Practice and Measurement Loop
- Learn a skill group from this guide + Microsoft Learn docs.
- Perform the lab checklist item.
- Drill free practice questions at /practice/azure-sc-300 filtered or reviewed by topic when possible.
- Log misses as concept, misread stem, or careless — only concept misses change the study plan.
- Re-test weekly with mixed sets under time pressure approaching 100 minutes.
Microsoft also offers an official practice assessment on Learn; use it for style familiarity, not as your only question source.
How the Rest of This Study Guide Is Organized
Later chapters follow the blueprint order: tenant administration, users/groups/devices, external identities, hybrid identity, authentication methods, Conditional Access, ID Protection and Global Secure Access, workload identities and apps, then entitlement management, access reviews, PIM, and monitoring. Each section targets exam-useful decisions, not encyclopedia dumps.
Keep the April 27, 2026 weights in mind whenever you are tempted to over-study a pet topic. If you are deep into app registrations but still weak on Conditional Access grant controls, rebalance toward Domain 2—that is how the scoring math wants you to study.
As of the April 27, 2026 skills measured, which SC-300 domain has the highest weight range?
Which skill group belongs primarily under Plan and automate identity governance?
A candidate has only 10 study hours left and equally weak scores in Conditional Access and company branding. Based on SC-300 weights, where should most of those hours go?
Which practice approach best matches this guide's study map for SC-300?