I85PREP
⌘ K
SC-300 study materials
SC-300 study resources

SC-300: Implement authentication and access management

SC-300 · Work through your exam, one topic at a time.

All guide sections

Implement authentication and access management

Authentication methods

The Authentication methods policy controls which methods a tenant allows: Microsoft Authenticator, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, Temporary Access Pass (TAP), SMS/voice, OATH tokens, and email OTP for guests. Registration is centralized and each method can be scoped to groups. TAP is a time-limited code used to bootstrap passwordless setup or recover a locked-out user.

Conditional Access anatomy

Every policy has assignments (users, groups, workload identities), target resources (cloud apps, user actions such as registering security info), conditions (sign-in risk, user risk, device platform, location, client app, device state, authentication flows), grant controls (block, require MFA, require compliant or hybrid-joined device, authentication strength, terms of use, approved client app), and session controls (sign-in frequency, persistent browser, application-enforced restrictions, continuous access evaluation). Identity Protection supplies user and sign-in risk levels and adds its own risk policies, which need P2.

Traps

  • Require multifactor authentication and Authentication strength are different controls; strength restricts which methods count.
  • Legacy authentication bypasses most controls unless you explicitly target the Other clients condition.
  • Excluded break-glass accounts are never evaluated, so always exclude at least one.
  • Report-only mode evaluates but does not enforce, which is the safe way to test.
  • A named location must be defined before a location condition can reference it.

Worked example

Block legacy auth: create a policy, include All users (exclude the break-glass account), target All cloud apps, set the client apps condition to Exchange ActiveSync clients plus Other clients, and set the grant control to Block. Run it in report-only for a week before enforcing.