SC-300 study plan
SC-300 · Give each week a clear focus.
8 weeks · About 7 hours per week
Implement and manage user identities
Create a trial tenant, add and verify a custom domain, and record the DNS records required for verification
Bulk-create 25 users from a CSV in the Microsoft Entra admin center, then repeat the same import with Microsoft Graph PowerShell
Configure self-service password reset scope for a pilot group and document the registration and notification settings you chose
Assign licenses directly and through group-based licensing, then verify license state for three users before and after group removal
Your checkpoint
A working trial tenant with one verified custom domain and 25 users created twice (portal CSV import and Graph PowerShell), plus a one-page log showing license state verified for three users across a group add/remove cycle.
Implement and manage user identities & Implement authentication and access management
Build five groups (assigned security, dynamic user, dynamic device, Microsoft 365, and nested) and validate dynamic membership rules against test users
Create an administrative unit and delegate a helpdesk-style role scoped to that unit only, then prove the scoping with a negative test
Configure directory synchronization options on paper and in the portal, comparing password hash sync, pass-through authentication, and cloud sync for a stated scenario
Implement group-based licensing with a rule that removes a license when a user leaves the group and confirm the removal
Your checkpoint
A group and role model document containing five groups with validated membership proof, one admin unit with a delegated role plus negative test result, and a written sync/auth-method recommendation with justification.
Implement authentication and access management
Enable the authentication methods policy, then register and test two methods for a pilot user
Configure Microsoft Entra Password Protection with a custom banned list and prove a blocked password is rejected
Set up combined security information registration and complete an end-to-end SSPR reset as a test user
Issue a Temporary Access Pass and use it to register a phishing-resistant method for a user without a password
Your checkpoint
An authentication methods matrix listing each enabled method, its scope, its prerequisite license, and a pass/fail result from at least one executed registration-or-reset test per method.
Implement authentication and access management
Author five Conditional Access policies: MFA for all administrators, block legacy authentication, require a compliant device for one cloud app, block access from a named location, and apply a session control to SharePoint Online
Configure named locations and a terms-of-use document and attach both to at least one policy
Test each policy with the What If tool and record expected versus actual evaluation for two sign-in scenarios per policy
Turn on Identity Protection risk-based policies in report-only mode and review the risk detections and risky users reports
Your checkpoint
A Conditional Access design document with all five policies described, each paired with a What If result table covering at least two sign-in scenarios plus a break-glass exclusion rationale.
Plan and implement workload identities
Register a multi-tenant application and configure redirect URIs, a certificate credential, and a client secret with expiry tracking
Add a gallery enterprise application and assign users and groups, then verify single sign-on configuration
Grant delegated and application Microsoft Graph permissions to an app and complete admin consent, recording the least-privilege result
Create one user-assigned and one system-assigned managed identity and grant each access to a target resource
Your checkpoint
A workload identity lab with one app registration holding a least-privilege Graph permission that successfully calls a protected resource, plus a permission and consent record table covering all apps and identities built this week.
Plan and implement workload identities & Plan and implement identity governance
Create Conditional Access policies scoped to workload identities and verify they apply to a targeted service principal only
Build an access package in entitlement management with an approval policy, an expiration, and an assigned catalog resource
Configure a recurring access review for a group and for guest users with auto-apply results enabled
Configure Privileged Identity Management for an Entra directory role with approval, justification, and time-bound activation, then activate it once
Your checkpoint
A governance artifact pack: one access package request that completed an approval, one scheduled access review with a review decision recorded, and a PIM activation trace showing justification and expiry.
Plan and implement identity governance & Implement and manage user identities
Build joiner, mover, and leaver lifecycle workflows triggered by attribute changes, including a Temporary Access Pass on joiner
Configure external collaboration settings and B2B cross-tenant access settings for one partner tenant
Run an end-to-end governance scenario: request an access package, approve it, run the review, and remove access on denial
Audit role assignments and license assignments to confirm no governance change silently breaks an existing Conditional Access policy
Your checkpoint
A timestamped end-to-end identity lifecycle record showing one user moving through joiner, mover, and leaver states, with the resulting access, license, and role changes captured at each step.
Implement and manage user identities & Implement authentication and access management & Plan and implement workload identities & Plan and implement identity governance
Take a full-length timed practice assessment and score at least 80 percent
Reconfigure in the lab every objective you missed on the practice assessment until each one passes
Write a one-page reference covering policy evaluation order, licensing prerequisites per feature, and the role required for each common task
Re-run all weekly deliverables end to end without notes to confirm retention
Your checkpoint
A timed practice assessment scored at 80 percent or higher, accompanied by a remediation log that lists every missed objective, the lab action taken to fix it, and the date it was re-verified.
Milestones
Week 2: Trial tenant has a verified custom domain, 25 users created two different ways, five validated groups, and one admin unit with a proven scoped delegation.
Week 4: All five Conditional Access policies are live in the tenant, each has a What If test table, and the authentication methods matrix shows at least one passing executed test per method.
Week 6: Workload identity lab passes end to end (least-privilege Graph call succeeds) and one access package approval, one access review decision, and one PIM activation are all recorded.
Week 8: Timed practice assessment scored 80 percent or higher and every missed objective on the remediation log is marked re-verified.