I85PREP
⌘ K
SC-300 study materials
SC-300 study resources

SC-300 practice questions

One question at a time. Build your SC-300 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Implement and manage user identities

When you create a cloud-only user in Microsoft Entra ID, which attribute must be unique within the tenant?

  1. Display name
  2. Mail nickname
  3. Office location
  4. User principal name Correct answer.

Explanation

The user principal name (UPN) is the sign-in identifier and must be unique in the tenant. Display names and office locations can be duplicated. Mail nickname is used for email aliases but is not the Entra ID sign-in identifier.

Question 2Implement and manage user identities

Which file format is used by the Microsoft Entra ID bulk user creation operation?

  1. JSON
  2. XML
  3. XLSX
  4. CSV Correct answer.

Explanation

Bulk user creation in Microsoft Entra ID uses a comma-separated values (CSV) template. The CSV includes columns such as user principal name, display name, and initial password settings. Other formats are not accepted by the bulk operation.

Question 3Implement and manage user identities

Which group type provides a shared mailbox, calendar, and SharePoint site for collaboration?

  1. Security group
  2. Distribution list
  3. Administrative unit
  4. Microsoft 365 group Correct answer.

Explanation

A Microsoft 365 group includes a shared mailbox, calendar, SharePoint site, and other collaboration resources. Security groups are used primarily for access management. Distribution lists are used only for email distribution.

Question 4Implement and manage user identities

What is the minimum Microsoft Entra ID license required to use dynamic membership rules for groups?

  1. Microsoft Entra ID Governance
  2. Microsoft Entra ID P1 Correct answer.
  3. Microsoft Entra ID Free
  4. Microsoft Entra ID P2

Explanation

Dynamic group membership requires Microsoft Entra ID P1 as the minimum license. P2 and Governance include P1 capabilities but are not the minimum required license. Free does not include dynamic membership rules.

Question 5Implement and manage user identities

How is an external collaborator represented in Microsoft Entra ID after accepting a B2B collaboration invitation?

  1. Member user account
  2. Managed identity
  3. Guest user account Correct answer.
  4. Service principal

Explanation

B2B collaboration invites external users as guest user objects in the directory. Guest users have limited default permissions and can be governed separately from member users. Service principals and managed identities represent applications or workloads, not external collaborators.

Question 6Implement and manage user identities

Which Microsoft Entra ID capability allows users to reset their own passwords without contacting the help desk?

  1. Access reviews
  2. Self-service password reset Correct answer.
  3. Password protection
  4. Conditional Access

Explanation

Self-service password reset (SSPR) lets users reset or change their passwords after verifying their identity with registered methods. Conditional Access controls access based on conditions. Password protection blocks weak or banned passwords.

Question 7Implement and manage user identities

Which feature prevents users from setting passwords that appear on a custom banned list?

  1. Conditional Access
  2. Privileged Identity Management
  3. Password protection Correct answer.
  4. Access reviews

Explanation

Microsoft Entra Password Protection enforces the global banned password list and any custom banned password list you define. It evaluates new passwords during password changes or resets. Conditional Access and access reviews do not evaluate password content.

Question 8Implement and manage user identities

Which authentication method is considered phishing-resistant?

  1. Voice call
  2. Microsoft Authenticator push notification
  3. SMS verification code
  4. FIDO2 security key Correct answer.

Explanation

FIDO2 security keys use public-key cryptography bound to the sign-in origin, making them phishing-resistant. SMS, voice calls, and push notifications can be intercepted or approved by an attacker.

Question 9Implement and manage user identities

You want users in the Sales department to receive a license automatically when they are added to a group. What should you configure?

  1. Direct license assignment for each user
  2. Group-based licensing on a security group Correct answer.
  3. Self-service group management
  4. A Conditional Access policy

Explanation

Group-based licensing assigns licenses to all members of a group and removes them when members leave. Direct assignment requires manual per-user management. Conditional Access and self-service group management do not assign licenses.

Question 10Implement and manage user identities

You plan to bulk-create users from a CSV file. Which attribute must be supplied for each user to sign in?

  1. User principal name Correct answer.
  2. Manager
  3. Department
  4. Usage location

Explanation

Each user needs a unique user principal name (UPN), which is the sign-in identifier. Usage location is required for some license assignments but not for sign-in itself. Department and manager are optional attributes.

Question 11Implement and manage user identities

Users from a partner Microsoft Entra tenant already complete MFA in their home tenant. You do not want them prompted for MFA again in your tenant. What should you configure?

  1. Cross-tenant access inbound trust settings that accept MFA claims Correct answer.
  2. A per-user MFA enforcement policy
  3. Trusted IPs in your Conditional Access policy
  4. Security defaults in the partner tenant

Explanation

Cross-tenant access settings can configure inbound trust so your tenant accepts MFA claims satisfied in the partner tenant. This avoids a second MFA prompt for trusted partner users. Trusted IPs and per-user MFA do not trust another tenant's MFA claims.

Question 12Implement and manage user identities

On-premises Active Directory users must be able to reset their password in the cloud and have the new password written back to AD DS. What is required?

  1. Microsoft Entra Connect with password writeback enabled Correct answer.
  2. Password hash synchronization alone
  3. AD FS federation
  4. Cloud-only user accounts

Explanation

Password writeback must be enabled in Microsoft Entra Connect for cloud password changes to be written back to on-premises AD DS. Password hash synchronization alone does not write passwords back. Cloud-only accounts have no on-premises password to update.

Question 13Implement and manage user identities

A new employee has no authentication methods registered. You need to issue a time-limited passcode so the employee can register methods. Which method should you use?

  1. Temporary Access Pass Correct answer.
  2. Email one-time passcode
  3. OATH hardware token
  4. Windows Hello for Business

Explanation

A Temporary Access Pass is a time-limited passcode that can be used to onboard a user and register other authentication methods. OATH tokens and Windows Hello require prior setup or hardware. Email one-time passcode is used for guest authentication, not for initial method registration.

Question 14Implement and manage user identities

Which dynamic group membership rule adds users whose Department attribute equals Sales?

  1. user.department -in "Sales"
  2. user.department -eq "Sales" Correct answer.
  3. user.department -match "Sales"
  4. user.department -contains "Sales"

Explanation

The -eq operator tests for an exact match, so user.department -eq "Sales" includes users whose department is exactly Sales. The -contains operator is used for collections, -match uses regular expressions, and -in checks membership in a set of values.

Question 15Implement and manage user identities

You want every Microsoft 365 group created by users to begin with a department code. What should you configure?

  1. Conditional Access policy
  2. Access review
  3. Group naming policy Correct answer.
  4. Group expiration policy

Explanation

A group naming policy can enforce a prefix, suffix, and blocked words for new Microsoft 365 groups. This lets you prepend a department code consistently. Expiration and access reviews manage lifecycle and membership, not names.

Question 16Implement and manage user identities

You need to ensure that only administrators can invite guest users. What should you configure?

  1. Password protection Correct answer.
  2. Conditional Access sign-in risk policy
  3. Group-based licensing
  4. External collaboration settings in Microsoft Entra ID

Explanation

External collaboration settings include guest invite restrictions, which can be limited to administrators and users in specific roles. Conditional Access, licensing, and password protection do not control who can send guest invitations.

Question 17Implement and manage user identities

A user has a direct assignment for Microsoft 365 E3 and also receives E3 through group-based licensing. You remove the user from the licensed group. What happens to the license?

  1. The license is removed because the group assignment takes precedence
  2. The user account is disabled automatically
  3. The group license is converted into a direct assignment
  4. The direct assignment remains in effect Correct answer.

Explanation

Removing a user from a licensed group removes only the group-based license assignment. Any direct license assignment remains in effect. Group-based licensing does not override or convert direct assignments.

Question 18Implement and manage user identities

You must have business managers confirm every quarter that guest users still require access. Which feature should you use?

  1. Access reviews Correct answer.
  2. Privileged Identity Management
  3. Password protection
  4. Conditional Access

Explanation

Access reviews can recertify guest access on a recurring schedule, with reviewers such as managers or group owners confirming continued need. Conditional Access controls sign-in conditions, not periodic access confirmation. PIM manages privileged role activation.

Question 19Implement and manage user identities

Users must be able to create security groups, but a group owner must approve each request. What should you enable?

  1. Group expiration
  2. Dynamic membership
  3. Self-service group management with approval Correct answer.
  4. Group naming policy

Explanation

Self-service group management allows users to create groups and can require owner approval before the group is created. Dynamic membership updates membership by rule, and expiration controls group lifetime. Naming policy enforces naming conventions.

Question 20Implement and manage user identities

An employee is on leave. The account must be prevented from signing in, but the mailbox and data must be retained. What should you do?

  1. Reset the user's password
  2. Block sign-in for the user Correct answer.
  3. Remove all assigned licenses
  4. Delete the user account

Explanation

Blocking sign-in prevents authentication while preserving the user object, mailbox, and data. Deleting the account removes it from normal use and starts the deleted-user retention period. Removing licenses can affect mailbox availability and data access.

Question 21Implement and manage user identities

By default, for how many days can a deleted user account be restored in Microsoft Entra ID?

  1. 7 days
  2. 30 days Correct answer.
  3. 90 days
  4. 14 days

Explanation

Deleted users are retained in Microsoft Entra ID for 30 days by default, during which an administrator can restore them. After that retention period, the account cannot be restored through the standard deleted users experience.

Question 22Implement and manage user identities

Which hybrid identity method synchronizes password hashes to Microsoft Entra ID so users can authenticate by using their on-premises password in the cloud?

  1. Federation
  2. Seamless single sign-on
  3. Pass-through authentication
  4. Password hash synchronization Correct answer.

Explanation

Password hash synchronization sends a hash of the on-premises password hash to Microsoft Entra ID, allowing cloud authentication with the same password. Pass-through authentication validates passwords on-premises without synchronizing password hashes. Federation redirects authentication to an on-premises identity provider.

Question 23Implement and manage user identities

A team needs a group email address, shared files, and membership that updates automatically based on department. Which group type should you use?

  1. Microsoft 365 group Correct answer.
  2. Administrative unit
  3. Distribution list
  4. Mail-enabled security group

Explanation

A Microsoft 365 group provides a group mailbox, shared SharePoint site, and support for dynamic membership rules. A distribution list provides email distribution only. A mail-enabled security group provides email and access management but not the full collaboration workspace.

Question 24Implement and manage user identities

You need to block organization-specific words in user passwords. What should you configure?

  1. Multifactor authentication
  2. Custom banned password list Correct answer.
  3. Conditional Access
  4. Self-service password reset

Explanation

A custom banned password list lets you add organization-specific terms that Microsoft Entra Password Protection blocks during password changes. Conditional Access, SSPR, and MFA do not inspect password content.

Question 25Implement and manage user identities

Which Microsoft Entra external collaboration capability lets users collaborate in Teams shared channels without creating a guest account in your tenant?

  1. B2B direct connect Correct answer.
  2. Cross-tenant synchronization
  3. B2B collaboration
  4. Entitlement management

Explanation

B2B direct connect supports Teams shared channels and allows external users to collaborate without a guest account in your directory. B2B collaboration creates guest user objects. Cross-tenant synchronization provisions users between tenants, and entitlement management governs access packages.

Question 26Implement and manage user identities

A guest user with the email address [email protected] is invited to the tenant fabrikam.onmicrosoft.com. Which user principal name is assigned to the guest object in Microsoft Entra ID?

  1. alex#EXT#@contoso.com
  2. [email protected]
  3. [email protected]
  4. alex_contoso.com#EXT#@fabrikam.onmicrosoft.com Correct answer.

Explanation

When an external user is invited, Microsoft Entra ID builds the guest user principal name by replacing the @ symbol in the invited address with an underscore and appending #EXT# before the hosting tenant domain. The object therefore lives in the inviting tenant while retaining a trace of the original address.

Question 27Implement and manage user identities

Which property on a user object in Microsoft Entra ID indicates whether the account is an internal member of the organization or an external guest?

  1. creationType
  2. accountEnabled
  3. userPrincipalName
  4. userType Correct answer.

Explanation

The userType property holds the values Member or Guest and drives default permissions and directory behavior for the account. It can be changed to convert an account between the two states without recreating the object.

Question 28Implement and manage user identities

By default, how many authentication methods must a user provide when resetting a password through self-service password reset?

  1. Three
  2. Two Correct answer.
  3. One
  4. Four

Explanation

Self-service password reset requires two authentication methods by default, which provides a second factor of verification. An administrator can reduce this requirement to one method in the password reset properties if the organization accepts the lower assurance.

Question 29Implement and manage user identities

You want users to register the Microsoft Authenticator app, a phone number, and a security key in one unified flow. Which setting should you enable?

  1. Combined registration for self-service password reset and multifactor authentication Correct answer.
  2. Smart lockout
  3. Password writeback
  4. Per-user Microsoft Entra multifactor authentication

Explanation

Combined registration presents a single interruption at the security info page where users register all methods once, and those methods serve both password reset and multifactor authentication. This avoids requiring users to register separately for each service.

Question 30Implement and manage user identities

Which property of a group determines whether its members are added manually or computed from a rule?

  1. Object type
  2. Source
  3. Group type
  4. Membership type Correct answer.

Explanation

The membership type is either Assigned, where administrators add and remove members, or Dynamic User or Dynamic Device, where a rule evaluates attributes to maintain membership. The group type separately describes whether the group is a security group or a Microsoft 365 group.

Question 31Implement and manage user identities

You plan to assign Microsoft 365 E3 licenses to users through a group. Which group type must you use?

  1. Security group Correct answer.
  2. Microsoft 365 group
  3. Administrative unit
  4. Distribution group

Explanation

Group-based licensing applies licenses to members of a security group, whether the group is cloud-only or synchronized from Active Directory. Distribution groups and administrative units are not supported targets for license assignment.

Question 32Implement and manage user identities

Which hybrid identity method validates user passwords directly against on-premises Active Directory by using an agent, without storing password hashes in the cloud?

  1. Federation with Active Directory Federation Services
  2. Pass-through authentication Correct answer.
  3. Cloud-only identity
  4. Password hash synchronization

Explanation

Pass-through authentication installs lightweight authentication agents on-premises that validate the user's password against Active Directory in real time. Because the password is never hashed and stored in Microsoft Entra ID, the organization retains on-premises password policy enforcement for cloud sign-ins.

Question 33Implement and manage user identities

You need a dynamic group that contains every user whose job title contains the word Manager. Which membership rule should you configure?

  1. (user.jobTitle = "Manager")
  2. (user.jobTitle -contains "Manager")
  3. (user.jobTitle -match "Manager") Correct answer.
  4. (user.department -match "Manager")

Explanation

The -match operator performs a string comparison against the attribute value, so a job title such as Sales Manager is included. The -contains operator is intended for multi-valued properties that store collections of values.

Question 34Implement and manage user identities

What is the minimum Microsoft Entra ID license required to configure a group expiration policy that deletes groups after a set period?

  1. Microsoft Entra ID P1 Correct answer.
  2. Microsoft Entra ID P2
  3. Microsoft Entra ID Free
  4. Microsoft Entra ID Governance

Explanation

Group expiration is a Microsoft Entra ID P1 capability, so the minimum license that enables the policy is P1. The policy can notify group owners before groups are deleted when no owner renews them.

Question 35Implement and manage user identities

Which feature lets you bundle group membership, application assignments, and SharePoint site access into a single package that users request and receive after approval?

  1. Access reviews
  2. Conditional Access
  3. Entitlement management Correct answer.
  4. Privileged Identity Management

Explanation

Entitlement management uses access packages to define the resources a user receives, together with request, approval, and expiration policies. It is the identity governance feature designed for packaging access for internal users and guests.

Question 36Implement and manage user identities

A guest user is hired as a full-time employee and must keep the same account while receiving member-level access. What should you do?

  1. Delete the guest account and send a new invitation
  2. Change the user principal name to the corporate domain
  3. Change the UserType property from Guest to Member Correct answer.
  4. Reset the password and require a change at next sign-in

Explanation

Changing userType from Guest to Member converts the existing object, so the object ID, group memberships, and assignments are preserved. The user then signs in as a normal member of the directory.

Question 37Implement and manage user identities

You must block all B2B collaboration with one specific partner tenant while still allowing collaboration with every other tenant. What should you configure?

  1. External collaboration settings in Microsoft Entra ID
  2. A Conditional Access policy targeting guest users
  3. Tenant restrictions
  4. Cross-tenant access settings with an organization-specific policy Correct answer.

Explanation

Cross-tenant access settings let you define default inbound and outbound policies plus organization-specific policies for individual tenants. Blocking a single partner is done by adding an organization-specific policy for that tenant's ID and setting inbound and outbound B2B collaboration to blocked.

Question 38Implement and manage user identities

Cloud-only users in your tenant must be able to reset their own passwords. Which license do those users require?

  1. Microsoft 365 E5
  2. None; self-service password reset is included for cloud users in all Microsoft Entra ID editions Correct answer.
  3. Microsoft Entra ID P1
  4. Microsoft Entra ID P2

Explanation

Self-service password reset for cloud-only users is included with every Microsoft Entra ID edition, including Free. Paid licenses become relevant for capabilities such as password writeback to on-premises Active Directory.

Question 39Implement and manage user identities

Users whose accounts are synchronized from on-premises Active Directory must reset their password in the cloud and have it written back to Active Directory. What is the minimum license each user needs?

  1. Microsoft Entra ID Free
  2. Microsoft Entra ID P2
  3. Microsoft Entra ID P1 Correct answer.
  4. Microsoft 365 Business Basic

Explanation

Password writeback is a Microsoft Entra ID P1 feature, so each user who resets a synchronized password in the cloud requires at least P1. Password hash synchronization or pass-through authentication plus the appropriate Connect configuration must also be in place.

Question 40Implement and manage user identities

You need Microsoft 365 groups that are created in the cloud to be written back to on-premises Active Directory. What should you enable?

  1. Directory extensions
  2. Seamless single sign-on
  3. Group writeback v2 Correct answer.
  4. Password writeback

Explanation

Group writeback v2 writes cloud-created Microsoft 365 groups, including their membership, to on-premises Active Directory so that Exchange hybrid scenarios can use them. It is configured in the optional features of Microsoft Entra Connect.

Question 41Implement and manage user identities

Before configuring directory synchronization, you must find on-premises objects that have invalid characters or duplicate attributes. Which tool should you use?

  1. Microsoft Graph PowerShell
  2. Microsoft Entra Connect wizard
  3. Microsoft Entra Connect Health
  4. IdFix Correct answer.

Explanation

IdFix scans Active Directory for problems such as unsupported characters, blank values in required attributes, and duplicates, and it can suggest or apply corrections. Remediating these errors before the first sync prevents objects from failing to synchronize.

Question 42Implement and manage user identities

You need to validate a new synchronization configuration without any changes being exported to Microsoft Entra ID. Which Microsoft Entra Connect feature should you enable?

  1. Staging mode Correct answer.
  2. Express settings
  3. Seamless single sign-on
  4. Organizational unit filtering

Explanation

Staging mode runs the full import and synchronization cycles on a server but disables export, so administrators can review the projected changes safely. The server can later be promoted to an active synchronization server.

Question 43Implement and manage user identities

You need to delegate the creation and management of groups to a help desk team without granting them the ability to manage users. Which built-in role should you assign?

  1. Global Reader
  2. User Administrator
  3. Helpdesk Administrator
  4. Groups Administrator Correct answer.

Explanation

The Groups Administrator role can create and manage groups and configure group settings across the tenant. It does not grant the ability to create or manage users, which keeps the delegation limited to group tasks.

Question 44Implement and manage user identities

You must invite 200 external partners to the directory in a single operation. What should you do?

  1. Use the bulk invite operation with a CSV file that lists the email addresses Correct answer.
  2. Create a dynamic group whose rule targets guest users
  3. Run a Graph PowerShell command once per partner
  4. Bulk create members by uploading a CSV file

Explanation

The bulk invite operation accepts a CSV file of email addresses and sends invitations to all listed recipients at once. Each invited address becomes a guest object in Microsoft Entra ID when the invitation is redeemed.

Question 45Implement and manage user identities

A user has a valid usage location and no other license assignments. The user is a direct member of GroupA, GroupA is a member of GroupB, and GroupB is assigned a Microsoft 365 E3 license. The license is not applied to the user. Why?

  1. The user must be enabled for per-user multifactor authentication before a license can be applied
  2. Group-based licensing evaluates only direct members and does not support nested group membership Correct answer.
  3. The license was assigned to a Microsoft 365 group rather than a security group
  4. The user must first be assigned the license directly and then have it removed

Explanation

Group-based licensing processes direct members of the licensed group only; membership inherited through a nested group is not evaluated. To license these users, the license must be assigned to GroupA or the users must be added directly to GroupB.

Question 46Implement and manage user identities

A customer-facing application must let consumers sign in with their existing Google or Facebook accounts. Which Microsoft solution should you use?

  1. Microsoft Entra External ID for customers Correct answer.
  2. Microsoft Entra B2B collaboration
  3. Cross-tenant synchronization
  4. Entitlement management

Explanation

Microsoft Entra External ID for customers provides identity experiences for consumer-facing applications and supports social identity providers such as Google and Facebook, along with local accounts. B2B collaboration is intended for partner users who have their own work accounts.

Question 47Implement and manage user identities

Legal requires that users accept a disclaimer before they can access a cloud application for the first time. What should you create?

  1. An authentication strength policy
  2. An access review
  3. A Conditional Access named location
  4. A terms of use object Correct answer.

Explanation

A terms of use object stores the legal disclaimer, and a Conditional Access policy then requires users to accept it before access is granted. The acceptance can be tracked per user and configured to expire.

Question 48Implement and manage user identities

A user must be able to activate membership in a privileged group only when performing a specific task, with approval required and automatic expiry. What should you configure?

  1. An access review for the group
  2. An entitlement management access package
  3. Privileged Identity Management for Groups Correct answer.
  4. A dynamic membership rule for the group

Explanation

Privileged Identity Management for Groups makes a user eligible for group membership so membership is activated on request, with approval, justification, and a time limit. This removes standing membership from sensitive groups.

Question 49Implement and manage user identities

You must ensure that only members of a designated security group can create Microsoft 365 groups. What should you configure?

  1. The group general settings that restrict Microsoft 365 group creation to a selected group Correct answer.
  2. Self-service group management with group owners
  3. A group naming policy
  4. A group expiration policy

Explanation

The group general settings include the option to restrict whether all users or only a selected security group can create Microsoft 365 groups. Restricting creation to a chosen group limits self-service group sprawl.

Question 50Implement and manage user identities

Which feature temporarily blocks sign-in attempts from attackers who are guessing passwords while legitimate users continue to sign in?

  1. Smart lockout Correct answer.
  2. Custom banned password list
  3. Per-user multifactor authentication
  4. Self-service password reset

Explanation

Smart lockout locks out the source of bad password attempts using familiar on-premises lockout behavior while ignoring sign-ins from valid users. This keeps the tenant protected without disrupting users who know their password.