SC-300 flashcards
SC-300 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Cloud-only user
- A user account created and mastered in Microsoft Entra ID; it has no on-premises Active Directory counterpart and is authenticated directly by Entra ID.
- Synced user
- A user object mastered in on-premises Active Directory and synchronized to Microsoft Entra ID; source of authority remains on-premises, and changes must be made there.
- Soft-deleted user
- A deleted Microsoft Entra ID user retained for 30 days; administrators can restore it during that period, after which permanent deletion occurs automatically.
- Dynamic group
- A group whose membership is calculated by a membership rule from user or device attributes; members cannot be added or removed manually.
- Assigned group
- A group whose membership is managed explicitly; administrators add or remove members, or owners manage membership, rather than using attribute-based rules.
- Administrative unit
- A container that scopes Microsoft Entra roles and policies to a subset of users, groups, or devices, limiting administrators to those objects.
- Custom security attribute
- A key-value attribute defined in an attribute set and assigned to supported Microsoft Entra objects; it can be used in attribute-based access control.
- Guest user
- An external identity invited into Microsoft Entra ID; it authenticates with its home account or a one-time passcode and is governed by external collaboration settings.
- Conditional Access
- A policy engine that grants or blocks access based on user, group, device, location, application, and risk signals; it requires Microsoft Entra ID P1.
- Report-only mode
- A Conditional Access policy state that evaluates and logs what would happen without enforcing controls; it is used to test policy impact before enabling.
- Named location
- A Conditional Access location object defined by IP ranges or countries and regions; it is used in policy conditions and to mark trusted locations.
- Sign-in risk
- A Microsoft Entra Identity Protection signal estimating the probability that a sign-in request is not from the identity's legitimate owner; risk policies require P2.
- User risk
- A Microsoft Entra Identity Protection signal estimating the probability that a user account is compromised; remediation can require a secure password change.
- Authentication methods policy
- The Microsoft Entra policy that controls which authentication methods users can register and use, including Microsoft Authenticator, FIDO2, and SMS.
- Password protection
- A Microsoft Entra feature that blocks weak or banned passwords using a global list plus an optional custom list; on-premises enforcement uses a DC agent.
- Session control
- A Conditional Access control that limits access after sign-in, such as sign-in frequency, persistent browser session, or application-enforced restrictions.
- App registration
- A Microsoft Entra object that defines an application's identity, redirect URIs, credentials, API permissions, and roles; it creates a service principal in the home tenant.
- Service principal
- The tenant-local identity for an application; it represents the app in a specific Microsoft Entra tenant and holds assignments, permissions, and consent.
- System-assigned managed identity
- A managed identity created with and tied to an Azure resource; it is deleted when the resource is deleted and cannot be shared across resources.
- User-assigned managed identity
- A standalone Azure managed identity that can be assigned to one or more resources and persists independently of any single resource lifecycle.
- Workload identity federation
- A trust relationship that lets an external workload, such as GitHub Actions, obtain Microsoft Entra tokens without storing a client secret or certificate.
- Delegated permission
- An API permission where the app acts as the signed-in user; effective access is the intersection of the app's permission and the user's own access.
- Application permission
- An API permission where the app acts as itself with no signed-in user; it typically requires admin consent and grants tenant-wide access.
- Federated credential
- A configuration on an app registration or managed identity that trusts tokens from an external identity provider based on issuer, subject, and audience.
- PIM eligible assignment
- A Microsoft Entra Privileged Identity Management assignment that requires activation before use; activation can require justification, approval, MFA, or a time limit.
- Access review
- A recurring Microsoft Entra ID Governance process where reviewers confirm or remove access to groups, applications, or roles; results can be auto-applied.
- Access package
- An Entitlement Management resource bundle containing groups, applications, and sites; users request it through a policy that defines approval and expiration.
- Catalog
- An Entitlement Management container for resources and access packages; access packages in a catalog can be requested by users scoped by policy.
- Lifecycle workflow
- A Microsoft Entra ID Governance automation that runs scheduled tasks, such as sending onboarding or offboarding emails, based on user attributes and events.
- Provisioning
- The automated creation, update, and deletion of user accounts in target applications or directories based on attribute mappings and scoping filters.
- Terms of use
- A policy document users must accept before accessing a resource; acceptance can be required by Conditional Access and recorded for audit.
- PIM for Groups
- Privileged Identity Management support for group membership and ownership; users activate eligible group membership to obtain associated resource access.