SC-300 · CHEAT SHEET

Microsoft Identity and Access Administrator

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Implement and manage user identities

20–25%

Configure and manage a Microsoft Entra tenant

Built-in roles have a fixed set of permissions that can't be modified; custom roles are a collection of permissions you pick from a preset list. Granting access is a two-step process: define the role, then assign it to a security principal (user, group or service principal) at a scope such as the tenant, an administrative unit or a resource.
Administrative units restrict the permissions of a role to the part of the organization you define, such as a region or a school, and can't be nested. When sensitive objects must be protected even from tenant-level administrators, use a restricted management administrative unit, which must be created with that setting from the start.
A Privileged Role Administrator creates administrative units in the Microsoft Entra admin center, PowerShell or Microsoft Graph, adds users, groups or devices as members, and assigns roles scoped to the unit. Membership can be assigned or dynamic (users or devices, not both), and role assignments are removed before a unit is deleted.
Effective permissions result from all role assignments that apply to a user, direct or through groups, and from their scope: tenant, administrative unit or resource. A unit-scoped role acts only on the unit's members and on users without administrator roles, not on tenant-wide settings. Some actions on accounts that hold roles require more privileged roles.
Domain Name Administrator is the least privileged role for managing domains. A custom domain is verified with a TXT or MX record at the registrar and can be verified in only one directory; subdomains are verified with the root domain. To delete a domain, remove its references first, or use ForceDelete, which renames them to the initial domain.

Create, configure, and manage Microsoft Entra identities

Users are created in Entra ID > Users as internal members, internal guests, external members or external guests. User Administrator is the least-privileged role to create users, and Guest Inviter can invite external guests. A deleted user stays in Deleted users for 30 days, where it can be restored, and its licenses become available to others.
Security groups manage access and can contain users, devices and service principals; Microsoft 365 groups contain only users but can include external guests. Membership can be assigned or dynamic (for users or for devices, never both). Role-assignable groups must be created as such, use assigned membership and do not support nesting.
Custom security attributes are key-value pairs, organized into attribute sets, that you define and assign to users and enterprise applications. Global Administrator has no permissions by default: Attribute Definition Administrator defines and Attribute Assignment Administrator assigns. Attributes are never deleted, only deactivated, and they cannot be used in dynamic group rules.
In the admin center, a User Administrator can bulk create, delete and invite users, and a Groups Administrator or the group owner can import members, always using CSV templates kept exactly as downloaded. Per-row errors appear in Bulk operation results. When portal jobs time out on large tenants, use Microsoft Graph PowerShell cmdlets.
A device gets an identity through registration (BYOD and mobile), Microsoft Entra join (organization-owned devices with work-account sign-in) or hybrid join (on-premises Active Directory plus Microsoft Entra). Device settings control who can join or register, MFA, the per-user limit and local administrators; Cloud Device Administrator can read and change them.

Implement and manage identities for external users and tenants

External collaboration settings define what guests can see in the directory (same access as members, limited by default, or only their own profile), who can invite guests (everyone, members and admin roles, only roles such as User Administrator or Guest Inviter, or no one), self-service sign-up, external user leave and domain restrictions (an allow list or a block list, never both).
An external user is invited from the Users area with at least the User Administrator role; a Guest account is created immediately in a pending acceptance state, and the invitation does not expire but can be resent. Groups and roles can be assigned at creation (roles require Privileged Role Administrator). For many users, bulk invite uses a CSV template whose first two rows must not be modified.
A guest is a user object whose UserType (Guest or Member) is independent of how the user signs in, which the Identities property shows. Resetting redemption status (at least Helpdesk Administrator) lets you change the email or provider while keeping the object, groups and assignments. Internal accounts can be converted to B2B, and external users can leave the organization according to the leave setting.
Cross-tenant access controls B2B collaboration and B2B direct connect with other Microsoft Entra organizations through inbound, outbound and trust settings (MFA and device claims). Defaults allow B2B collaboration and block direct connect, and organizational settings take precedence over them. It is configured with at least Security Administrator, and automatic redemption must be selected in both tenants.
Cross-tenant synchronization pushes internal users from a source tenant into a target tenant as B2B users, with external member as the default. The target allows synchronization in its inbound settings and both tenants enable automatic redemption; the configuration, scope and attribute mappings are defined in the source. Removing a user from scope soft deletes the user in the target.

Implement and manage hybrid identity

Microsoft Entra Connect Sync is the on-premises sync engine of Microsoft Entra Connect: it creates and maintains users, groups and other objects and synchronizes password hashes. Only one server can be active; a second server in staging mode imports and synchronizes but does not export, and is used for fault tolerance and to test changes before it is made active.
Cloud Sync synchronizes users, groups and contacts from Active Directory to Microsoft Entra ID through lightweight provisioning agents that only make outbound connections, with the configuration managed in the cloud. It supports several active agents with failover and disconnected forests. It offers scoping filters, attribute mapping, on-demand provisioning and accidental delete protection.
Password hash synchronization sends Microsoft Entra ID a hash derived from the hash of the on-premises password, so users have the same password in the cloud, and it enables leaked credential detection. On-premises complexity rules override the cloud ones and, by default, the cloud password never expires. It can also serve as a backup when AD FS federation is used.
Pass-through authentication validates the password directly against Active Directory through lightweight agents that only make outbound connections, without storing passwords in the cloud or needing a perimeter network. It works with Conditional Access. For high availability, more agents are installed on other servers (one per server); there is no automatic failover to password hash synchronization.
Seamless SSO signs users in automatically on domain-joined devices inside the corporate network, with no additional on-premises components. It is combined with password hash synchronization or pass-through authentication, not with AD FS. It creates the AZUREADSSOACC account in each forest and requires adding the autologon URL to the Local intranet zone; its Kerberos key should be rolled over regularly.

2. Implement authentication and access management

25–30%

Plan, implement, and manage Microsoft Entra user authentication

The Authentication methods policy is the recommended place to enable methods for all users or specific groups, and it replaces the legacy MFA and SSPR policies. Conditional Access authentication strengths require specific method combinations, and Microsoft recommends phishing-resistant methods such as Windows Hello for Business, passkeys (FIDO2) and certificates.
A Temporary Access Pass is a time-limited passcode, single-use or multi-use, that works for primary authentication and helps onboard passwordless methods or recover access. Passkeys (FIDO2), certificate-based authentication, Windows Hello for Business and passkeys in Microsoft Authenticator are among the phishing-resistant methods.
Report suspicious activity replaces the legacy block and unblock users, fraud alert and notifications features, and sets the reporting user to high risk in ID Protection. The legacy service settings include trusted IPs and remembering MFA on trusted devices, although Conditional Access named locations are the recommended approach.
Self-service password reset is enabled for none, selected or all users, and configured by at least an Authentication Policy Administrator. The number of required methods, one or two, is defined and users must register them; users with on-premises passwords need password writeback and administrator accounts follow a stricter policy.
Windows Hello for Business combines a device-bound asymmetric key protected by the TPM with a PIN or biometric gesture, and biometric data never leaves the device. In hybrid environments cloud Kerberos trust is the recommended model because it needs no PKI. Non-destructive PIN reset needs the PIN reset service and the PIN recovery policy.

Plan, implement, and manage Microsoft Entra Conditional Access

Plan Conditional Access as if-then rules: assignments (users, resources, conditions) plus grant or session controls. A policy only acts when its conditions match, so pair a scoped policy with a block policy for everyone else. Exclude emergency access accounts, validate with report-only mode and the What If tool, and roll out in phases.
Assignments define who and what a policy targets. You can include or exclude users, groups, built-in directory roles, guest or external user types and workload identities; exclusion always overrides inclusion. Target resources can be apps, All resources, user actions or authentication contexts, and conditions such as platform, client apps, location and risk narrow the scope.
Grant controls either block access or grant it once requirements are met: MFA, authentication strength, compliant device, Microsoft Entra hybrid joined device, app protection policy and password change. With several controls you choose require all or require one. Require password change must target All resources and can't be combined with other controls, and MFA and authentication strength can't be used together in one policy.
Test before enforcing: report-only mode evaluates policies on real sign-ins without enforcing them, and the results appear in the sign-in logs and the Insights and reporting workbook. The What If tool simulates a sign-in and lists the policies that apply or don't, with reasons. For a real failure, review the Conditional Access tab of the sign-in event and its correlation ID.
Session controls limit what happens after access is granted: app enforced restrictions, Conditional Access App Control, sign-in frequency, persistent browser session, continuous access evaluation, token protection and resilience defaults. Sign-in frequency sets when users must reauthenticate, and a persistent browser session lets users stay signed in after closing the browser.

Manage risk by using Microsoft Entra ID Protection

The user risk policy is created in Conditional Access with the User risk condition, and Microsoft recommends applying it at the High level with the Require risk remediation control. That control automatically adds authentication strength and sign-in frequency every time: users with passwords complete MFA and a secure password change, and passwordless users have their sessions revoked.
The sign-in risk policy is created in Conditional Access, in a separate policy from the user risk one. Microsoft recommends requiring the Multifactor authentication strength at medium or high risk with sign-in frequency every time, excluding emergency access accounts and testing first in report-only mode. Users must be registered for MFA to self-remediate.
The authentication methods policy enables methods for all users or specific groups, and the registration campaign is configured there by an Authentication Policy Administrator. The campaign nudges users to set up Authenticator or a passkey after they complete MFA, with an option to snooze. Temporary Access Pass and Conditional Access on Register security information protect the registration.
ID Protection provides the Risky users, Risky sign-ins and Risk detections reports. After investigating, an administrator can confirm compromise, confirm safe or dismiss the risk; the Security Operator role is enough to dismiss user risk. To remediate, an administrator can generate a temporary password, require a password change or block the user.
ID Protection detects risk on service principals and applications, but not on managed identities. Investigation happens in the Risky workload identities report, where you can dismiss the risk, confirm compromise or disable the service principal. Conditional Access for workload identities can only block access, and remediation means rotating the credentials.

Implement Global Secure Access

The Global Secure Access client sends only the traffic defined by the forwarding profiles to the service and leaves everything else going directly to the network. It exists for Windows, macOS, Android and iOS: Windows and macOS are deployed with Intune packages and profiles, while Android and iOS are part of Microsoft Defender for Endpoint. Registry keys or app configuration control which actions users see.
Microsoft Entra Private Access replaces a VPN by tunneling through the client the FQDNs and IP addresses you define as private. Quick Access holds the primary set of destinations, while Global Secure Access enterprise apps provide their own per-app segments, user assignments and Conditional Access. Private network connectors, organized in groups on Windows Server, make only outbound connections.
Microsoft Entra Internet Access is an identity-aware secure web gateway. Web content filtering, threat intelligence, TLS inspection and content policies are grouped into security profiles delivered through Conditional Access session controls, and the baseline profile applies to all traffic at the lowest priority. Policies are processed by priority, from 100 to 65,000.
The Microsoft traffic profile acquires traffic to Microsoft 365 services using rules derived from the Microsoft 365 IP and FQDN list, grouped by workload such as Exchange Online or SharePoint Online. Each rule or group can be set to Forward or Bypass, and the profile can be scoped to users, groups or remote networks. It is enabled with the Global Secure Access Administrator role and is required for source IP restoration.

3. Plan and implement workload identities

20–25%

Plan and implement identities for applications and Azure workloads

Managed identities give Azure resources a Microsoft Entra identity whose credentials Azure manages and rotates, so they are preferred in Azure. Use a service principal (app registration) outside Azure, ideally with a certificate. Avoid user accounts as service accounts; on-premises use a gMSA, then an sMSA.
A system-assigned identity is created by enabling it on an Azure resource and is deleted with it; a user-assigned identity is a standalone resource created in a resource group. Creating or deleting user-assigned identities requires the Managed Identity Contributor role. Create them in the portal, with az identity create, or with New-AzUserAssignedIdentity.
A system-assigned identity is enabled on the resource itself and needs write permission over it (for example Virtual Machine Contributor); assigning a user-assigned identity also needs the Managed Identity Operator role over the identity. A resource can combine both types, and in App Service the configuration is specific to each slot.
After assigning the identity you must grant it access to the target, usually with an Azure RBAC role assignment (for example Storage Blob Data Reader or Key Vault Secrets User). Code requests tokens from the local endpoint and must name the identity when several user-assigned ones exist. Microsoft Graph permissions are granted as app roles to the service principal.

Plan, implement, and monitor the integration of enterprise applications

Enterprise application settings apply at two levels. Application-level properties (enabled for sign-in, assignment required, visible to users, logo and homepage URL) are set per app in the Properties pane by an administrator or owner. Tenant-level settings control who can register applications, how users consent, and the admin consent workflow.
Application Administrator manages enterprise applications, app registrations and Application Proxy settings; Cloud Application Administrator has the same permissions except Application Proxy. Neither manages Conditional Access, and both can add credentials to an app. An owner manages only the applications they own.
Application Proxy publishes on-premises web apps through a cloud service and a private network connector that uses only outbound connections, so no inbound ports are opened. Connectors are organized in groups, Microsoft Entra ID pre-authentication enables Conditional Access, and Kerberos constrained delegation gives SSO to Integrated Windows Authentication apps from a domain-joined connector.
SaaS apps are added from the Microsoft Entra gallery through New application, which creates an enterprise application that should be given owners. The SSO method depends on how the app authenticates: OpenID Connect and OAuth when supported, SAML for existing apps without them, password-based when there is an HTML sign-in page, and linked when SSO is handled elsewhere.
Users and groups are assigned in an enterprise application's Users and groups pane, optionally with an app role defined in the app registration; apps without roles use Default Access. Group assignment does not cascade to nested groups. Assignment required limits who can get tokens, and disabling an app role does not remove existing assignments from tokens.

Plan and implement app registrations

Before registering an app, decide who can use it (one tenant, many tenants or personal accounts), who can register it (Application Developer if you restrict the user setting) and which identity fits. A managed identity is preferable when the app runs in Azure and does not sign in users. The application object lives in the home tenant and each tenant that uses the app has its own service principal.
You register an app in the Microsoft Entra admin center under App registrations, signed in as at least Application Developer. You pick a name and the supported account types and receive a unique application (client) ID. Registration sets up a one-way trust with the identity platform and creates the application object and its service principal in the home tenant.
Under Authentication you add redirect URIs per platform (Web, single-page, Android, iOS/macOS, mobile and desktop); they match case-sensitively and only allow http for localhost. Public clients turn on Allow public client flows and hold no secrets. For credentials Microsoft prefers managed identity or federated credentials, then certificates, and avoids secrets in production.
Under API permissions you add delegated permissions (the app acts on behalf of a user and reaches only what that user can) or application permissions (no user, for services and daemons). Application permissions need administrator consent, while users can consent to delegated ones unless they are high privilege. Always request the minimum needed and revoke what is not required.
App roles are defined on the app or API registration (display name, allowed member types, a value without spaces, description and enabled state). They are assigned to users and groups from Enterprise apps, or to other apps as application permissions with admin consent. They arrive in the token in the roles claim. To delete a role, disable it first.

Manage and monitor app access by using Microsoft Defender for Cloud Apps

Cloud Discovery analyzes traffic logs against the Cloud app catalog to give visibility into shadow IT and app risk. Continuous reports come from the Defender for Endpoint integration, a log collector or a secure web gateway; snapshot reports come from manually uploaded logs. In the dashboard you filter discovered apps and exclude noisy entities.
App connectors use the provider's APIs, encrypted over HTTPS, to give visibility into accounts and activities and governance actions such as suspending users, removing app tokens or quarantining files. Several instances of the same app can be connected, except Microsoft 365 and Azure. Microsoft 365 needs auditing enabled and an application administrator role.
Use app enforced restrictions is a Conditional Access session control that makes Microsoft Entra ID pass device information to SharePoint Online or Exchange Online, which give a limited or full experience depending on whether the device is managed and compliant. In SharePoint, limited access is web-only with no download, print or sync; in Exchange, Set-OwaMailboxPolicy applies.
Conditional Access app control routes browser sessions to Defender for Cloud Apps through a Conditional Access policy with the Use Conditional Access App Control session control (monitor only, block downloads or a custom policy). Microsoft Entra apps are onboarded automatically; apps from other identity providers are onboarded manually. Edge uses in-browser protection; other browsers show mcas.ms.
Access policies allow (Audit) or block access based on user, device, location, app and client app; the Mobile and desktop filter reaches built-in clients. Session policies allow access but control the session: Monitor only, Block activities, or control file download and upload with inspection, using the Audit, Block or Protect actions. When policies conflict, the more restrictive wins.

4. Plan and automate identity governance

20–25%

Plan and implement entitlement management in Microsoft Entra

Entitlement management bundles the resource roles an identity needs into an access package, governed by policies that define who can request, who approves and when access expires. Packages live in catalogs, which enable delegation through the catalog creator, catalog owner and access package manager roles. Internal and external requestors need separate policies.
A catalog is a container of resources and access packages, created by an administrator or a catalog creator, who becomes its owner. It accepts cloud-created groups, enterprise applications and SharePoint sites, but not on-premises AD groups or distribution groups. Enabled for external users controls self-service requests, and a catalog can be deleted only when it has no access packages.
An access package is created inside a catalog and cannot be moved to another one afterwards. It contains resource roles from the catalog's resources and needs at least one policy: for users in the directory, for users not in the directory, or administrator direct assignment only. The policy sets staged approval, expiration and reviews; the Hidden setting controls whether it shows in the My Access portal.
The Requests tab of a package shows who requested, under which policy and in which state; the request history shows who approved and with what justification. Partially delivered or failed requests can be reprocessed, and pending requests that have not been delivered can be canceled. Removing a completed request does not remove the assignment, and nobody can approve their own request.
Microsoft Entra terms of use are uploaded as PDF documents, can be offered in several languages, and are enforced through a Conditional Access policy before a user reaches the application. They can require users to expand them, to accept on every device, or to re-accept when consent expires. A report and the audit logs show who accepted or declined, and a user who declines gets no access.

Plan, implement, and manage access reviews in Microsoft Entra

Planning a review means deciding which resources to review, whose access is in scope, how often, who reviews (owners, delegates, users themselves or their managers, with fallback reviewers) and what automatic action applies if nobody responds. Start with a pilot on noncritical resources and without auto-applying results.
Reviews are created under ID Governance > Access Reviews by choosing the resource (groups or applications), scope (everyone or guests only), reviewers, duration and recurrence. Settings cover auto apply of results, what happens if reviewers do not respond, decision helpers, justification, reminders and multi-stage reviews.
The Overview page shows progress of the current instance, and Results lets you stop, reset and download results as CSV; Review history keeps earlier instances. Review activity is recorded in the Microsoft Entra audit logs, which can be exported to Log Analytics, and downloadable history reports can also be created.
Reviewers open the review from the email or My Access and choose Approve, Deny or Don't know for each user, giving a reason where required, and can change their response until the review ends. Denied users are removed when the review ends or is stopped; with several reviewers the last submitted response prevails.

Plan and implement privileged access

In PIM, Microsoft Entra roles give just-in-time access: assignments can be eligible or active, permanent or time-bound. Settings are defined per role (maximum activation duration, MFA, authentication context, justification, approval and notifications), and at least the Privileged Role Administrator role is needed to manage them.
Azure resource roles in PIM are managed by subscription administrators and resource Owners or User Access Administrators. Settings are per role and per resource and are not inherited from a subscription down to a resource group. On activation the user can reduce the scope, and approval requires choosing at least one approver because there are no defaults.
PIM for Groups grants just-in-time membership or ownership of security and Microsoft 365 groups, with one policy for membership and another for ownership. Dynamic groups and groups synchronized from on-premises cannot be managed, and a group must be role-assignable to receive a Microsoft Entra role.
When a role requires approval, delegated approvers get an email and resolve the request in Approve requests; the first approver to respond resolves it. Approvers need no role and have 24 hours, a window that is not configurable. For Microsoft Entra roles, approvers cannot approve their own requests.
PIM offers Resource audit (all role activity for the resource) and My audit (only your own activity), and its data is a subset of the Microsoft Entra audit logs. To keep it longer, use diagnostic settings to Log Analytics or storage, and for Azure you can export assignments with child resources to CSV.

Monitor identity activity by using logs, workbooks, and reports

Sign-in, audit and provisioning logs are available under Monitoring & health in the Microsoft Entra admin center, and Reports Reader is the least privileged role to read them. Sign-in logs include interactive, non-interactive, service principal and managed identity sign-ins; audit logs cover changes to users, groups, applications and licenses; provisioning logs show action and status.
Diagnostic settings send Microsoft Entra logs to a Log Analytics workspace, a storage account or an event hub, and you can create several settings with different destinations. Security Administrator is the least privileged role to create them, and the destination must exist beforehand. Use Log Analytics to query, an event hub to feed SIEM tools, and storage for long-term archiving.
In Log Analytics you query Entra logs with KQL, starting from a table such as SigninLogs, AuditLogs or AADProvisioningLogs and piping operators such as where, project, extend, summarize and sort. A time filter with ago() limits the range, bin() groups by time, and in SigninLogs a ResultType of 0 means success. Log Analytics shows each request separately, so group by CorrelationId to get one result per sign-in.
Microsoft Entra workbooks visualize identity data and require a Log Analytics workspace that receives the logs through diagnostic settings. Public templates cover scenarios such as Conditional Access gap analysis, legacy authentication sign-ins, sensitive operations, cross-tenant access, authentication prompts and risk analysis. The Usage and insights reports add application, authentication method and credential activity.
Identity Secure Score is a percentage that shows how closely your tenant follows Microsoft's identity security recommendations, and it is the identity part of Microsoft secure score. It is recalculated every day, some actions earn partial credit, and each improvement action has a status such as To address, Planned, Risk accepted or Resolved through third party. It does not measure the likelihood of a breach.

Practice this certification