SC-300 Study Guide: Master Microsoft Identity and Access Administrator Certification

The SC-300 Microsoft Identity and Access Administrator certification covers designing, implementing and managing identity and access solutions with Microsoft Entra ID. This associate-level certification has grown in value as organisations adopt zero-trust security and cloud-first identity management. Whether you are an identity administrator, security engineer or Azure specialist, the exam tests both the concepts and the practical implementation detail across several identity domains.

This SC-300 study guide covers the exam structure, each domain, the main concepts, common traps and hands-on practice.

SC-300 Exam Structure

SC-300 is an associate-level Microsoft exam on implementing and managing identity solutions in Microsoft Entra ID. It uses Microsoft's standard question types: multiple choice, multiple answer, drag and drop, and case studies.

Exam Specifications

• Passing Score: 700 out of 1000
• Number of Questions: Approximately 40-60 questions
• Exam Duration: 100 minutes of exam time (about 120 minutes seat time)
• Difficulty Level: Associate
• Languages Available: English and regional variations

The exam is proctored, either at a Pearson VUE test centre or online. You register through Microsoft Learn or your organisation's training portal. A score of 700 usually means answering 70-75% of questions correctly, although the exact percentage varies because questions carry different weights.

Who Should Take the SC-300

SC-300 is aimed at professionals with 1-3 years of experience implementing and managing identity solutions, such as:

• Identity and Access Management (IAM) administrators
• Security engineers responsible for identity infrastructure
• Azure Active Directory (now Microsoft Entra ID) specialists
• Cloud architects designing identity solutions
• Security operations centre (SOC) professionals
• Compliance and governance specialists implementing access controls

You should have hands-on experience with Microsoft Entra ID, conditional access policies and authentication methods. Basic Azure knowledge helps but is not required. Many candidates take SC-300 after AZ-900 (Azure Fundamentals), or when they move from on-premises Active Directory administration to cloud identity management.

SC-300 Exam Domains and Weightings

The SC-300 exam has four domains. The weightings show where to spend your study time.

Authentication and access management has the highest weighting, so give it proportionally more study time while still covering the other three domains.

Domain 1: Implement Identities in Microsoft Entra ID (20-25%)

This domain covers setting up identities in Microsoft Entra ID, Microsoft's cloud identity and access management service (formerly Azure Active Directory).

Tenant Management and Configuration

You need to know how to configure and manage Microsoft Entra ID tenants. A tenant is the dedicated instance of Microsoft Entra ID that an organisation receives when it signs up for Azure. The main concepts are:

• Tenant structure: Each organisation has at least one tenant. Multiple tenants support complex scenarios with separate identity silos
• Directory roles: Global Administrator, User Administrator, Password Administrator, and helpdesk roles each have specific permissions
• Custom domains: Configuring custom domain names instead of the default onmicrosoft.com domain
• Tenant properties: Display name, technical contact, notification language, and tenant ID

Global Administrator is the most powerful role, so assign it under the principle of least privilege. Protect privileged accounts with conditional access and PIM (Privileged Identity Management).

User and Group Management

Creating and managing user identities is core SC-300 material. It covers:

• User types: Cloud-only users created directly in Microsoft Entra ID versus hybrid users synchronised from on-premises Active Directory
• User properties: User principal name (UPN), mail attributes, department, manager, and custom attributes
• Bulk operations: Importing users in bulk through CSV files using the Azure portal or PowerShell
• Guest users: Inviting external users for B2B collaboration with specific access rights

Groups organise users and simplify access management. Know the differences between:

• Security groups: Used for access management to resources
• Microsoft 365 groups: Support collaboration through Teams, SharePoint, and Exchange
• Distribution lists: Legacy group type for email distribution (being phased out)

Dynamic groups use membership rules based on user attributes. For example, a dynamic group might automatically include every user whose department is "Engineering", which saves updating membership by hand.

Hybrid Identity Configuration

Many organisations run a hybrid environment, with on-premises Active Directory connected to Microsoft Entra ID. The implementation details to know:

• Microsoft Entra Connect: The synchronisation tool connecting on-premises AD to cloud directories
• Synchronisation options: Full synchronisation, password hash synchronisation, pass-through authentication, or federated authentication
• Filtering: Selecting which organisational units, users, and groups synchronise to the cloud
• Writeback features: Password writeback, device writeback, and group writeback for specific scenarios

For hybrid identity, password hash synchronisation is the simplest approach to set up. It can also run as a backup for federated authentication or pass-through authentication, so sign-in keeps working if AD FS or the pass-through agents go down. Pass-through authentication itself needs agents in your on-premises environment.

Domain 2: Implement Authentication and Access Management (25-30%)

This domain covers modern authentication methods and access control. It has the highest weighting on the exam.

Authentication Methods and Multi-Factor Authentication

Microsoft Entra ID supports these authentication methods:

• Password authentication: Traditional username and password (still required as fallback)
• Windows Hello for Business: Biometric or PIN sign-in built into Windows 10 and 11 devices
• FIDO2 security keys: Hardware tokens supporting passwordless sign-in
• Microsoft Authenticator app: Mobile app providing push notifications for approval-based MFA
• Temporary Access Pass: Single-use codes for onboarding or emergency access

Multi-Factor Authentication (MFA) makes users prove their identity in more than one way. For the exam, know:

• MFA enforcement methods: Per-user MFA, conditional access policies, or authentication strength policies
• MFA methods: SMS (less secure), phone call, authenticator app, or hardware tokens
• Phishing-resistant authentication: FIDO2 keys and Windows Hello for Business provide the strongest protection against phishing attacks

Be ready to explain why passwordless authentication is stronger. Passwords are compromised through phishing, reuse and weak practices. Passwordless methods such as FIDO2 keys prove possession of a device, which makes them more secure.

Self-Service Password Reset (SSPR)

SSPR lets users reset forgotten passwords without contacting the helpdesk. Setting it up involves:

• SSPR registration: Users register authentication methods through myaccount.microsoft.com
• Authentication methods for SSPR: Users must register at least one authentication method (often mobile phone or security questions)
• Licensing requirements: Requires Microsoft Entra ID P1 or P2, or Microsoft 365 licences
• Writeback to on-premises: Optional feature synchronising cloud password resets back to on-premises Active Directory

SSPR cuts helpdesk costs and improves the user experience. The exam tests which scenarios SSPR supports and how to configure it.

Conditional Access Policies

Conditional Access is the main access management tool in Microsoft Entra ID. Its policies make access decisions based on conditions such as device, location, risk level or application.

A conditional access policy contains:

• Assignments: Which users, groups, or roles the policy applies to
• Conditions: Signals triggering policy evaluation (device platform, location, client app, sign-in risk)
• Access controls: Grant controls requiring MFA, compliant devices, or session controls limiting token lifetime
• What-if tool: Testing policies before enforcement

Common conditional access scenarios include:

• Requiring MFA when signing in from unknown locations
• Blocking access from non-compliant devices
• Requiring session controls for sensitive applications like Office 365
• Granting access only to users in specific security groups

An important exam point: Conditional Access policies work at the sign-in layer and cannot protect against threats after a user gains access. That is why they are paired with other controls such as Privileged Identity Management.

Risk-Based Access Decisions

Microsoft Entra ID uses risk signals from multiple sources to detect compromised accounts:

• User risk: Indicators that an account is compromised (leaked credentials, atypical behaviour)
• Sign-in risk: Real-time indicators during authentication (impossible travel, unfamiliar location, malware-infected device)
• Workload identity risk: Risk for applications and service principals

Risk-based conditional access policies automatically block high-risk sign-ins or require additional authentication. Organisations with Microsoft Entra ID P2 get identity protection features that assess risk continuously.

Domain 3: Implement Access Management for Applications (15-20%)

This domain covers securing access to applications with modern identity protocols and Microsoft Entra application integration.

Application Registration and Service Principals

Applications accessing Microsoft Entra ID protected resources must be registered. The registration creates:

• Application object: Metadata about the application in the tenant where it's registered
• Service principal: Local representation of the application in each tenant where it's used
• Service principal types: Application (from an app registration), managed identity (system-assigned or user-assigned), and legacy

When registering applications, you configure:

• Redirect URIs: Where users are redirected after authentication (security-critical to prevent token leakage)
• API permissions: Delegated permissions requiring user consent or application permissions for service-to-service scenarios
• Certificates and secrets: Credentials allowing applications to authenticate to Microsoft Entra ID
• Owners: Users managing the application registration

The exam distinguishes between delegated permissions (acting on behalf of a signed-in user) and application permissions (acting as the application itself without user context).

OAuth 2.0 and OpenID Connect

SC-300 expects you to know the modern authentication protocols:

• OAuth 2.0: Authorization framework for delegating access
• OpenID Connect: Identity layer built on OAuth 2.0 adding authentication
• Authorization code flow: Most secure flow for web applications and SPAs
• Implicit flow: Legacy flow (being phased out) less secure than authorization code
• Client credentials flow: Service-to-service authentication without user involvement

The authorization code flow secures applications by:
1. Redirecting users to Microsoft Entra ID login
2. Microsoft Entra ID returns an authorization code to the application
3. The application exchanges the code for tokens server-to-server (prevents token exposure)

Implicit flow directly returns tokens to the browser, increasing exposure risk. Modern applications should use authorization code flow with Proof Key for Code Exchange (PKCE) for additional security.

API Permissions and Consent

Applications request permissions to access resources on behalf of users:

• Delegated permissions: Application acts as the signed-in user
• Application permissions: Application acts independently without user context
• Admin consent: Required for sensitive permissions or application permissions
• Incremental consent: Requesting permissions at the time they're needed

The exam tests when admin consent is required and how the consent framework works. Users can consent to low-risk delegated permissions themselves. Sensitive permissions need admin consent, which admins grant through the portal.

Domain 4: Plan and Implement Identity Governance (20-25%)

Identity governance keeps each user's access appropriate across their lifecycle, from hiring to offboarding.

Privileged Identity Management (PIM)

PIM protects high-risk administrative roles through:

• Just-in-time (JIT) access: Users request elevated privileges for limited durations rather than holding permanent assignments
• Approval workflows: Designated approvers review and approve elevation requests
• Audit logs: Complete audit trails of who activated what role and when
• Time-bound assignments: Temporary role assignments automatically expiring

Implementing PIM involves:

• Eligible assignments: Users are eligible for a role but don't have it active
• Activation: Users activate eligible roles for temporary periods (1-8 hours typically)
• Approval requirements: Configuring who approves activation requests
• Alerts and reviews: Notifications of PIM activity and periodic reviews of role assignments

PIM is distinct from Conditional Access and RBAC. RBAC controls what resources users can access. Conditional Access enforces authentication policies. PIM adds time-based restrictions and approval workflows to sensitive role assignments.

Access Reviews

Access reviews check that users keep only the access they need. A review has these parts:

• Review creation: Defining scope (group membership, application access, or role assignment)
• Reviewers: Managers, group owners, or users self-reviewing their access
• Review decisions: Approve (user keeps access) or deny (access removed)
• Remediation: Automatically removing denied access
• Recurring reviews: Scheduling periodic reviews instead of one-time reviews

Access reviews deal with access creep, where users collect permissions over time. Regular reviews keep access levels appropriate. The exam tests both how to set up reviews and why they matter for governance.

Entitlement Management

Entitlement Management (EM) bundles access so users can request it through a controlled process:

• Access packages: Collections of application roles, group memberships, and SharePoint site access bundled for request
• Catalogs: Collections of access packages available to specific user populations
• Access requests: Users request access packages through a self-service portal
• Approval policies: Managers approve access requests based on defined policies
• Lifecycle management: Automatic access expiration and re-certification

Entitlement Management cuts manual provisioning work and improves compliance. It is most useful for organisations with many applications and complex access requirements.

Identity Lifecycle Management

Identity lifecycle management covers onboarding, offboarding, and privilege escalation:

• Onboarding workflows: Automatically provisioning accounts and access when employees join
• Offboarding automation: Disabling accounts, revoking tokens, and removing group memberships when employees leave
• Transfer workflows: Moving employees to new roles with appropriate access changes
• Leaving employee tasks: Nominating account owners, transferring data, and removing sensitive access

Automation shortens the time ex-employees keep access after they leave.

Common SC-300 Exam Traps and Misconceptions

The traps below catch candidates out on SC-300 questions.

Trap 1: Confusing Conditional Access with RBAC

Conditional Access enforces authentication policies at sign-in (e.g., "require MFA"). RBAC controls what resources a user can access after authentication (e.g., "can modify storage accounts"). Exam questions often present scenarios where you must identify whether the solution involves authentication or authorization.

Example: "Users connecting from home must provide additional authentication." This requires Conditional Access. "Users in the Finance department should have read-only access to the HR database." This requires RBAC.

Trap 2: PIM vs. Permanent Role Assignment

Some questions describe a scenario where permanent role assignment would work, but PIM is the correct answer. PIM is the better choice because:

• It reduces standing privilege exposure
• It enforces approval workflows
• It provides audit trails
• It follows zero-trust principles

If a question asks for the most secure approach, PIM is usually correct.

Trap 3: Password Hash Synchronisation Limitations

Password hash synchronisation is a sign-in method in its own right, and it can also run alongside federated authentication (AD FS) or pass-through authentication as a backup, so sign-in keeps working if federation or the pass-through agents fail. Some answer options suggest it cannot be combined with those methods, and those options are wrong.

Trap 4: Writeback Feature Confusion

Password writeback synchronises password resets from cloud to on-premises. Device writeback registers cloud devices in on-premises AD. Group writeback synchronises Microsoft 365 groups back to on-premises. Questions ask which writeback feature fits a given scenario.

Trap 5: Consent Framework Details

Admin consent is required for application permissions (service-to-service) and sensitive delegated permissions. Users can consent to low-risk delegated permissions themselves. Questions ask you to tell which consent type a scenario needs.

Hands-On Lab Recommendations

SC-300 is a practical exam that expects hands-on experience. Microsoft Learn provides free sandbox environments for practice:

• Microsoft Learn modules: Free, guided labs covering SC-300 topics with sandbox access
• Azure free tier: Free $200 credit for 30 days to practice in your own tenant
• Test tenant: Create free test tenants at tenant.microsoft.com for low-risk experimentation

Recommended hands-on practice areas:

• Create users, groups, and assign licences in Microsoft Entra ID
• Configure conditional access policies and test them with different user scenarios
• Set up SSPR and passwordless authentication methods
• Register applications and configure API permissions
• Implement PIM for a test role and request activation
• Create and run access reviews on groups
• Configure entitlement management access packages

Hands-on experience helps you see what each configuration choice does in practice, and how to troubleshoot the common issues that exam scenarios describe.

Final Exam Tips

• Read questions carefully: Pay attention to key words like "minimum administrative effort" or "most secure"
• Eliminate obviously wrong answers: Use process of elimination when unsure
• Consider the business context: Choose solutions that fit the described organisational requirements
• Practice time management: Allow roughly 2 minutes per question during the exam
• Review flagged questions: Use remaining time to revisit uncertain answers

Summary

SC-300 tests technical implementation and also your judgement about which solution fits a business scenario. Spend most of your preparation on hands-on work with Microsoft Entra ID, conditional access policies and governance tools, and review the traps around authentication methods, synchronisation and consent. Pair your reading with lab work, because the exam expects practical experience.

A free SC-300 preview is at azureprep.com; full access to everything is one All-Access subscription (monthly or annual).