← cd ~/learn

This page isn't affiliated with Microsoft. The weights come from Microsoft's study guide; always check it for the current outline before you book.

Skills measured, and where to learn them

1. Implement and manage user identities20–25%
   • Configure Entra roles, custom roles and administrative units
   • Manage domains, company branding and tenant settings
   • Create and manage users, groups and custom security attributes
   • Bulk operations, device join and registration, licence assignment
   • External collaboration, B2B invitations and cross-tenant sync
   • Hybrid identity: Connect Sync, Cloud Sync, PHS, PTA, Seamless SSO, AD FS migration
   Study this on azureblog.co.uk

   • pathShrinking hybrid identity
   • pathEntra ID foundations for new admins
   • cheat sheetentra licensing cheat sheet
   • cheat sheetgraph powershell cheat sheet
   • postGroup-based licensing: finding and fixing assignment errors
   • postEntra Connect Sync is on its way out. Start planning for Cloud Sync.
   • postConverting synced users to cloud-managed: Source of Authority is GA
   • postCross-tenant group sync is GA: one group, many tenants
   • postBYOD Windows access with Entra registration is now GA
   • postHybrid join without Entra Connect: hybrid join using Entra Kerberos
   • postSoft delete for Entra device objects: a safety net for device clean-ups
   • postTenant configuration management: snapshot your Entra config and catch drift
   • postEntra Backup and Recovery is here: an undo button for your tenant
   • postSOC Identity Responder: contain a compromised account without handing out admin roles
2. Implement authentication and access management25–30%
   • Authentication methods: CBA, TAP, Authenticator, passkeys (FIDO2)
   • Tenant-wide MFA, SSPR, Windows Hello for Business and password protection
   • Disable accounts and revoke sessions; Entra Kerberos for hybrid
   • Plan, test and troubleshoot Conditional Access policies
   • Session controls, CAE, authentication context and protected actions
   • ID Protection: user and sign-in risk, risky users and workload identities
   • Global Secure Access: clients, Private Access, Internet Access, Microsoft traffic
   Study this on azureblog.co.uk

   • pathConditional Access from zero
   • pathPasswordless rollout
   • labBuild a Conditional Access baseline in report-only
   • explainerHow Conditional Access evaluates a sign-in
   • explainerHow Intune compliance reaches Conditional Access
   • cheat sheetauthentication methods cheat sheet
   • cheat sheetconditional access cheat sheet
   • cheat sheetintune compliance cheat sheet
   • postAuthentication strengths: requiring the right kind of MFA
   • postTemporary Access Pass: onboarding users without a password
   • postSynced passkeys and passkey profiles are now GA in Entra ID
   • postSystem-preferred authentication now picks the first factor too
   • postMicrosoft is retiring its own SMS and voice MFA. Here's your plan.
   • postExternal MFA is GA: third-party MFA without giving up Conditional Access
   • postMicrosoft Authenticator now blocks jailbroken and rooted devices
   • postTest Conditional Access safely with report-only mode and What If
   • postNamed locations: getting IP ranges and countries right in Conditional Access
   • postRolling out "require compliant device" without a flood of tickets
   • postConfigurable token lifetimes are GA: when to shorten them (and when not to)
3. Plan and implement workload identities20–25%
   • Choose between managed identities, service principals and service accounts
   • Create and assign managed identities to Azure resources
   • Configure enterprise apps, SaaS integration and application proxy
   • Manage user and admin consent, app assignments and app roles
   • Create app registrations, API permissions and app roles
   • Defender for Cloud Apps: discovery, app control, session and OAuth app policies
   Study this on azureblog.co.uk

   • pathAutomating Entra and Azure safely
   • explainerHow Entra ID issues and refreshes tokens
   • cheat sheetgraph powershell cheat sheet
   • postManaged identities vs service principals: which should your workload use?
   • postLock down app consent without blocking your users
   • postRolling a SAML signing certificate without an outage
   • postAADSTS75011: when the app insists on how you signed in
   • postSCIM provisioning when every target is its own app
   • postFind expiring app secrets and certificates before they bite
   • postUnattended Graph PowerShell scripts with certificate authentication
   • postDeploy from GitHub Actions to Azure without storing a single secret
   • postEntra Agent ID: giving AI agents real identities
4. Plan and automate identity governance20–25%
   • Entitlement management: catalogs, access packages, terms of use, connected organisations
   • Plan, configure and monitor access reviews
   • PIM for Entra roles, Azure resources and groups; approvals and audit
   • Create and manage emergency access accounts
   • Sign-in, audit and provisioning logs; diagnostic settings and KQL
   • Workbooks, reports and Identity Secure Score
   Study this on azureblog.co.uk

   • pathLocking down admin access
   • pathIdentity security operations
   • labSet up break-glass accounts with a sign-in alert
   • cheat sheetpim cheat sheet
   • cheat sheetkql basics cheat sheet
   • postClean up guest accounts with access reviews
   • postActivate PIM roles from PowerShell with Microsoft Graph
   • postRequire phishing-resistant MFA on every PIM activation
   • postBreak-glass accounts done right
   • postSix KQL queries for Entra sign-in logs every admin should keep
   • postAccount Discovery: find the accounts your SaaS apps forgot to tell you about

20 practice questions

Scenario questions in the style of the exam, written for this site. Get 16 or more right to earn the SC-300 badge, and see which areas to revise.

1. Helpdesk staff in Paris must be able to reset passwords for Paris users only, not for anyone else in the tenant. What should you configure?

   An administrative unit for Paris users, with the Helpdesk Administrator role assigned at that scopeThe Helpdesk Administrator role assigned at tenant scopeA dynamic group for Paris users with the helpdesk staff as ownersA custom Azure RBAC role on the Paris resource group
2. You synchronise users from Active Directory. Users must keep signing in to Microsoft 365 if on-premises domain controllers are unavailable, and you want leaked credential detection in ID Protection. Which sign-in method should you use?

   Password hash synchronisationPass-through authenticationFederation with AD FSSeamless SSO on its own
3. Your organisation has two Entra tenants after an acquisition. Users in tenant A must be created and kept up to date automatically in tenant B so they can collaborate. What should you configure?

   Cross-tenant synchronisation from tenant A to tenant BBulk invitation of tenant A users from a CSV fileEntra Connect Sync in each tenant pointing at the same forestExternal identity provider federation with SAML
4. All users whose department attribute is Finance must be added to a security group automatically, and removed when they move department. What should you create?

   A security group with dynamic membership rulesAn assigned security group managed by the Finance managerA Microsoft 365 group with self-service join enabledAn administrative unit for the Finance department
5. Staff must only be able to invite guests from three named partner domains. What should you configure?

   An allow list of domains in external collaboration settingsCross-tenant access settings that block all inbound accessA Conditional Access policy targeting guest usersA terms of use policy for guests
6. New starters must register a passkey on their first day without ever being given a password. What should you issue them?

   A Temporary Access PassA one-time SMS codeA temporary password that must be changed at first sign-inA bypass code from the MFA server
7. Administrators must use passkeys or certificate-based authentication when accessing admin portals. Authenticator push notifications must not be accepted. What should your Conditional Access policy require?

   The built-in phishing-resistant MFA authentication strengthThe Require multifactor authentication grant controlA sign-in frequency of one hourAn approved client app
8. A user's account has been compromised. You must stop the attacker using existing refresh tokens as quickly as possible. What should you do?

   Disable the account and revoke the user's sessionsRemove the user's Microsoft 365 licenceDelete the user's registered Authenticator app onlyAdd the user to a group excluded from Conditional Access
9. You must require secure remediation when a user's risk is High. The legacy ID Protection risk policies were scheduled to retire on 1 October 2026. Where should you configure this?

   A Conditional Access policy that uses the user risk conditionThe legacy user risk policy in ID ProtectionAn anomaly detection policy in Defender for Cloud AppsSecurity defaults
10. You want to replace a legacy VPN that gives remote staff access to internal apps and servers, using identity-centric Zero Trust access with Conditional Access. What should you deploy?

    Microsoft Entra Private Access with the Global Secure Access clientMicrosoft Entra Internet AccessThe Microsoft traffic profile onlyAzure Bastion
11. Five Azure VMs run the same app and must all use the same identity to reach Azure SQL. The identity must survive if any VM is deleted. What should you use?

    A user-assigned managed identity assigned to each VMA system-assigned managed identity on each VMA service principal with a client secret on each VMA shared user account with a non-expiring password
12. You have blocked user consent to apps. Users need a way to request an app that needs permissions, which reviewers then approve or deny. What should you configure?

    The admin consent workflowAllow user consent for apps from all publishersAn app registration with no API permissionsA Conditional Access policy that blocks the app
13. A custom web app must decide what users can do based on whether they are an Approver or a Reader, using a claim in the token. What should you configure?

    App roles in the app registration, assigned to users or groups in the enterprise applicationAPI permissions with delegated Microsoft Graph scopesDirectory roles assigned to the usersCustom security attributes on the users
14. Users may open SharePoint Online on personal devices, but downloads from those devices must be blocked in real time. What should you configure?

    Conditional Access app control with a Defender for Cloud Apps session policyA Defender for Cloud Apps OAuth app policyAn access review on the SharePoint siteCloud Discovery with a log collector
15. A SaaS enterprise application is visible to every user in the tenant. Only members of the Legal group should be able to sign in. What should you do?

    Set Assignment required to Yes and assign the Legal group to the applicationHide the application from My AppsRemove the application's ownersDelete the users' consent grants for the application
16. Users from a partner organisation should request access to a project's Teams team and SharePoint site, with sponsor approval, and lose access automatically when it expires. What should you set up?

    An access package in entitlement management with the partner as a connected organisationIndividual B2B invitations with a calendar reminderCross-tenant synchronisation from the partner tenantA dynamic group based on the guests' domain
17. Guest access to Microsoft 365 groups must be reviewed every quarter, and guests whose reviewers don't respond must lose access automatically. What should you configure?

    A recurring access review with auto-apply results and the no-response action set to remove accessA one-off access review with recommendations turned offA lifecycle workflow for leaversA Conditional Access sign-in frequency policy for guests
18. Membership of a group that grants access to a sensitive app must be just in time, with approval and a time limit. What should you use?

    PIM for Groups with eligible membershipA dynamic membership ruleAn access review on the groupGroup writeback to Active Directory
19. Sign-in and audit logs must be kept longer than the built-in retention period and queried with KQL alongside other security data. What should you configure?

    Diagnostic settings that send the logs to a Log Analytics workspaceA scheduled CSV download from the admin centreDiagnostic settings that send the logs to an event hub onlyIdentity Secure Score
20. You are creating emergency access accounts. Which design follows Microsoft's guidance?

    Two or more cloud-only accounts on the onmicrosoft.com domain, protected by passkeys and monitored with alertsOne account synchronised from Active Directory with a non-expiring passwordTwo accounts federated through AD FS so they share on-premises policiesOne account per administrator, using their own Authenticator app

check my answers