SC-300 key terms

Microsoft's cloud identity and access management service, formerly Azure AD, that stores users, groups, and applications and issues the tokens used to sign in to Microsoft and third-party services.

A dedicated, isolated instance of Microsoft Entra ID created when an organization signs up for a Microsoft cloud service; it holds that organization's users, groups, and application definitions.

A directory object representing a person who can sign in, carrying attributes such as user principal name, department, manager, and usage location, plus any assigned licenses.

An account created in your tenant for someone outside the organization so they can sign in with their own credentials; the user principal name includes an #EXT# marker.

A directory object that collects users, devices, or service principals so that permissions, licenses, and policies can be applied to every member at once.

A membership rule that evaluates user or device attributes and then automatically adds or removes members, so the group stays accurate without manual updates.

A container that limits where an administrator's role assignment applies, for example to the users of one country, so a helpdesk can manage only its own scope.

Business-specific key-value pairs stored on directory objects and grouped into attribute sets, usable for filtering objects and for making attribute-based access decisions.

Assigning Microsoft 365 licenses to a group rather than to individuals; every member receives a license automatically and membership changes add or remove licenses.

An on-premises synchronization tool that copies Active Directory Domain Services objects to Microsoft Entra ID and can also enable password hash sync, pass-through authentication, or federation.

A hybrid sign-in option where a hash of the on-premises password hash is copied to Microsoft Entra ID, letting users authenticate in the cloud with their existing password.

A hybrid sign-in option where Microsoft Entra ID validates the password against on-premises Active Directory through small agents, so no password hash is stored in the cloud.

A lightweight, cloud-managed agent that synchronizes on-premises Active Directory objects to Microsoft Entra ID and supports multi-forest and disconnected directory topologies.

A requirement that a sign-in present at least two independent proofs of identity, such as a password plus an authenticator approval, a phone call, or a security key.

An if-then rule that checks signals such as user, group, app, device, location, and risk, then blocks access, requires extra controls, or applies session restrictions.

A defined set of IP addresses or countries that policies can reference, so access from known office networks can be treated differently from access on unknown networks.

Tenant-wide settings that decide which authentication methods users may register and use, and whether a method applies to everyone or only to selected groups.

A short-lived passcode issued by an administrator that lets a user register passwordless methods or regain access when their normal credentials are unavailable.

A hardware authenticator that provides phishing-resistant passwordless sign-in by proving possession of the device and binding the credential to the website's origin.

A passwordless credential tied to a specific device and unlocked with a PIN or biometrics; authentication uses an asymmetric key pair, so no password is transmitted.

A Conditional Access grant control that demands a named combination of methods, such as phishing-resistant MFA, instead of accepting any form of multi-factor authentication.

A monitoring service that scores users and sign-ins for risk using signals such as leaked credentials and atypical travel, and can feed that risk into Conditional Access.

A single suspicious event or known-bad signal, such as an anonymous IP address or a password spray, that contributes to a user's or a sign-in's risk level.

A feature that lets users reset or unlock their own account by verifying registered methods, optionally writing the new password back to on-premises Active Directory.

A service that publishes on-premises web applications to remote users through Microsoft Entra ID sign-in, avoiding the need to open inbound firewall ports.

An enterprise application setup where Microsoft Entra ID issues SAML assertions, so a user who signs in once reaches a third-party application without a second login.

Automatic creation, update, and disablement of accounts in a connected application using the SCIM standard, driven by user and group changes in Microsoft Entra ID.

The definition of an application's identity in Microsoft Entra ID, including its client ID, redirect URIs, credentials, and the API permissions it requests.

The per-tenant instance of an application that records what the app may access in that tenant; it is created at registration time or when an administrator grants consent.

An identity automatically created and maintained for an Azure resource, letting the resource call APIs without any secret stored in code or configuration.

A trust configuration where a token from an external platform such as GitHub, Kubernetes, or AWS is exchanged for a Microsoft Entra ID token, so no client secret must be stored.

An API permission under which the app acts as the signed-in user, so real access is limited to the overlap between the app's permission and the user's own rights.

An app-only API permission that lets a service principal act with its own identity and without a signed-in user; it usually requires tenant-wide administrator consent.

An administrator's approval of an application's requested permissions for the whole tenant, required for app-only permissions and for any permission marked as high privilege.

Policies that target service principals rather than people, using signals such as location and risk to block or restrict what a non-human identity can do.

A service that grants eligible, time-bound directory or resource roles; users activate a role when needed with justification, and approval or MFA can be required.

A recurring process in which reviewers confirm or remove continued access to a group, application, or role, with the outcome applied automatically or after approval.

Governance of access through access packages, which bundle resources with a policy defining who may request them, who approves, and when the access expires.

Automated rules triggered by joiner, mover, or leaver events that run tasks such as sending welcome emails, adding users to groups, or disabling accounts.