SC-300 cheat sheet

Cloud-only users are mastered in Microsoft Entra ID; synced users are mastered in on-premises AD DS and remain source-anchored there.

Deleting a user moves it to the soft-deleted state for 30 days; restoration is supported during that period, and permanent deletion removes the object immediately.

Dynamic group membership requires an Entra ID P1 license and cannot be edited manually; assigned groups require explicit membership changes.

Administrative units scope role assignments to selected users, groups, or devices; restricted management administrative units protect sensitive objects from broader administrators.

Custom security attributes are defined in attribute sets and support attribute-based access control; assignment requires appropriate Attribute Administrator roles.

Guest invitations can be sent by portal, PowerShell, or Microsoft Graph; external collaboration settings control who may invite guests and guest directory permissions.

Group-based licensing assigns licenses through group membership and requires Entra ID P1; removing a user from the group removes the associated license.

UPN changes for synced users must be made on-premises; cloud-only UPN changes can be made in Entra ID and may require domain verification.

Conditional Access requires Entra ID P1; risk-based user and sign-in policies require Entra ID P2.

All applicable Conditional Access policies are evaluated; access is blocked if any policy blocks, and grant controls from multiple policies must all be satisfied.

Report-only mode logs policy results without enforcing controls; it is used to validate policy impact before switching a policy to On.

Named locations define trusted IP ranges or countries/regions; they can be used in policy conditions and to exclude trusted locations from MFA.

Authentication methods policy controls registration and use of methods; SSPR and MFA settings are managed there rather than through legacy per-user MFA.

Password protection uses a global banned-password list plus an optional custom banned list; on-premises password filter enforcement requires the DC agent.

Identity Protection generates sign-in risk and user risk; user-risk remediation commonly requires a secure password change.

Session controls include sign-in frequency, persistent browser, and application-enforced restrictions; token protection binds tokens to a device.

Security defaults provide baseline MFA but are replaced by Conditional Access when Conditional Access policies are enabled.

An app registration defines an application's identity and configuration; a service principal is the app's tenant-local identity used for assignments and consent.

System-assigned managed identities share the resource lifecycle; user-assigned managed identities are independent and reusable across resources.

Workload identity federation uses a federated credential with issuer, subject, and audience instead of a client secret or certificate.

Client secrets have a maximum lifetime of 24 months; certificates are preferred for stronger credential management.

Delegated permissions combine app consent and signed-in user access; application permissions run as the app and generally require admin consent.

App roles define authorization values assigned to users, groups, or service principals; assignment can be required to access the enterprise app.

Conditional Access for workload identities targets service principals and requires Workload Identities Premium licensing.

Service principal sign-in logs record app-only authentication; managed identity sign-ins appear in Entra sign-in logs with the managed identity as the principal.

Federated credentials on managed identities support workload identity federation for Azure-hosted or external workloads.

PIM eligible assignments require activation; active assignments are always in effect until removed or expired.

PIM activation can require MFA, justification, approval, and a maximum duration; role settings control these requirements.

Access reviews can target group membership, application assignments, and privileged role assignments; auto-apply removes denied access.

Entitlement Management uses catalogs, access packages, and policies; approval, expiration, and access reviews are configured in policies.

Lifecycle workflows trigger on schedules or attribute changes and can run tasks such as disabling accounts, removing licenses, or sending notifications.

Provisioning uses attribute mappings and scoping filters; initial cycles can be scoped to all users or specific groups.

Terms of use acceptance can be required by Conditional Access; acceptance records include user, timestamp, and device.

PIM for Groups manages eligible membership and ownership; activation grants associated resource access for a limited time.

Access reviews can be single-stage or multi-stage; reviewers can be managers, group owners, or specified users.