SC-300 study guide
SC-300 · Work through your exam, one topic at a time.
Microsoft Certified: Identity and Access Administrator Associate is an intermediate-level Microsoft certification aimed at security engineers who design, implement, and operate identity and access management with Microsoft Entra. The role covers configuring and managing identities across their lifecycles for users, devices, Azure resources, and applications, applying Zero Trust principles, delivering self-service experiences, and handling troubleshooting, monitoring, and reporting. The credential is listed under the Azure product with Security as its subject and requires renewal every 12 months, which you complete at no cost by passing an online assessment on Microsoft Learn. Exam SC-300 is proctored, gives you 100 minutes to complete the assessment, may include interactive components, and is offered in ten languages including English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), and both Simplified and Traditional Chinese. The SC-300 study guide has 4 sections and about 1,286 words.
01Implement and manage user identities
Microsoft Entra ID (formerly Azure AD) stores users that are cloud-only, synchronized from AD DS via Connect Sync or Cloud Sync, or invited as B2B guests. Groups are security or Microsoft 365, with assigned or dynamic membership.
304 words, about 2 min02Implement authentication and access management
The Authentication methods policy controls which methods a tenant allows: Microsoft Authenticator, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, Temporary Access Pass (TAP), SMS/voice, OATH tokens, and email OTP for guests. Registration is centralized and each method can be scoped to groups.
319 words, about 2 min03Plan and implement workload identities
Registering an app creates an app registration - the definition: redirect URIs, secrets or certificates, API permissions, exposed scopes, and app roles. Consenting to that app creates a service principal in your tenant, the local identity that actually holds role assignments and access.
325 words, about 2 min04Plan and implement identity governance
PIM makes role assignments eligible instead of permanent. Activation can require approval, MFA, and justification, and is time-bound to a maximum duration.
338 words, about 2 min