Exam SC-300: Microsoft Identity and Access Administrator earns the Microsoft Certified: Identity and Access Administrator Associate. It covers identity on Microsoft Entra from end to end: users, groups and hybrid identity, MFA and passkeys, Conditional Access, ID Protection, Global Secure Access, managed identities and app registrations, Defender for Cloud Apps, and governance with access reviews and Privileged Identity Management (PIM). The skills measured were last updated on 28 October 2026.
Identity is the main security perimeter in Zero Trust, and SC-300 roles (IAM engineer, Entra administrator) are in demand at GCCs in Hyderabad and Bengaluru. This guide follows the official study guide: four skill areas with weights, the features to tell apart, a 6-week plan and 15 original scenario questions.
Quick facts (Microsoft Learn, November 2026)
| Item | Detail |
|---|---|
| Certification | Microsoft Certified: Identity and Access Administrator Associate |
| Passing score | 700 |
| Skills measured | As of 28 October 2026 (minor changes to authentication, Global Secure Access and privileged access) |
| Renewal | Every year, with a free online assessment on Microsoft Learn |
| Expected skills | Azure, Microsoft 365, AD DS, PowerShell and KQL |
| Price | Based on the country where you take the exam (Pearson VUE) |
Read the official SC-300 study guide before booking. If you're new to Microsoft security, start with the SC-900 guide.
Skills measured and weights
| Skill area | Weight |
|---|---|
| Implement and manage user identities | 20–25% |
| Implement authentication and access management | 25–30% |
| Plan and implement workload identities | 20–25% |
| Plan and automate identity governance | 20–25% |
1. User identities (20–25%)
- Tenant: built-in and custom Entra roles; administrative units; effective permissions; custom domains; company branding; tenant, user, group and device settings.
- Identities: users and groups; custom security attributes; bulk operations in the admin centre and PowerShell; device join and registration; licences.
- External users: external collaboration settings; B2B invitations; cross-tenant access settings; cross-tenant synchronisation; SAML and WS-Fed identity providers.
- Hybrid identity: Entra Connect Sync vs Cloud Sync; password hash sync; pass-through authentication; seamless SSO; migrating from AD FS; Connect Health.
2. Authentication and access (25–30%)
- Authentication: certificate-based authentication; Temporary Access Pass; Microsoft Authenticator; passkeys (FIDO2); tenant-wide MFA; SSPR; Windows Hello for Business; revoking sessions; password protection; Entra Kerberos for hybrid identities.
- Conditional Access: assignments and controls; testing with What If and report-only mode; session management; device-enforced restrictions; continuous access evaluation; authentication context; protected actions; templates.
- ID Protection: user risk and sign-in risk policies; MFA registration campaigns; investigating risky users, sign-ins and workload identities.
- Global Secure Access: clients; Entra Private Access (VPN replacement); Entra Internet Access; the Microsoft 365 traffic profile.
| Sync option | Use it when |
|---|---|
| Password hash sync | Default choice: cloud authentication, works if on-premises AD is down, enables leaked-credential detection |
| Pass-through authentication | Passwords must be validated on-premises at sign-in |
| Federation (AD FS) | Legacy requirement; Microsoft recommends migrating away |
| Cloud Sync | Lightweight agents, multiple disconnected forests, simpler setup |
| Connect Sync | Complex sync rules, device writeback and other advanced features |
3. Workload identities (20–25%)
- Managed identities: system-assigned vs user-assigned; using them to access other Azure resources without secrets.
- Enterprise apps: app settings; app admin roles; Application Proxy for on-premises apps; SaaS integration (SAML, OIDC, provisioning); app roles; user and admin consent; collections.
- App registrations: authentication; API permissions (delegated vs application); app roles.
- Defender for Cloud Apps: cloud discovery; connected apps; Conditional Access app control; access and session policies; OAuth app policies; the app catalogue.
4. Identity governance (20–25%)
- Entitlement management: catalogs; access packages; requests and approvals; terms of use; external user lifecycle; connected organisations.
- Access reviews: planning, creating, monitoring and responding.
- Privileged access: PIM for Entra roles, Azure resources and groups; approvals; audit history; emergency access (break-glass) accounts.
- Monitoring: sign-in, audit and provisioning logs; diagnostic settings to Log Analytics, storage or Event Hubs; KQL; workbooks; Identity Secure Score.
// KQL: users with many failed sign-ins in the last day (Log Analytics)
SigninLogs
| where TimeGenerated > ago(1d) and ResultType != "0"
| summarize Failures = count(), Apps = make_set(AppDisplayName, 5) by UserPrincipalName
| where Failures > 10
| order by Failures desc6-week study plan
| Week | Focus | Lab (Entra ID trial tenant) |
|---|---|---|
| 1 | Tenant settings, roles, administrative units, users, groups, bulk operations | Create an admin unit for one city with a scoped helpdesk admin |
| 2 | Hybrid identity: Connect Sync, Cloud Sync, PHS, PTA, seamless SSO; B2B and cross-tenant settings | Sync a small AD lab with Cloud Sync |
| 3 | Authentication methods, passkeys, TAP, SSPR, password protection | Roll out passkeys with a TAP for onboarding |
| 4 | Conditional Access, ID Protection, continuous access evaluation, Global Secure Access | Policy requiring compliant devices and MFA; test with What If |
| 5 | Managed identities, app registrations, enterprise apps, App Proxy, Defender for Cloud Apps | VM reads Key Vault with a managed identity; SAML SSO to a SaaS app |
| 6 | Entitlement management, access reviews, PIM, logs and KQL, Secure Score; Practice Assessment | Eligible Global Admin role with approval; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. Helpdesk staff in Hyderabad should reset passwords only for Hyderabad users. What do you use?
An administrative unit with a scoped Helpdesk Administrator role.
2. Users must keep signing in even if the on-premises AD is down. Which hybrid sign-in method?
Password hash synchronisation.
3. Two company tenants must automatically share user accounts after a merger. What do you set up?
Cross-tenant synchronisation with cross-tenant access settings.
4. A new employee has no password yet but must register a passkey on day one. What do you issue?
A Temporary Access Pass.
5. Access to the finance app must require a compliant device and MFA. What do you create?
A Conditional Access policy targeting the app, with grant controls for MFA and a compliant device.
6. You want to see the impact of a new policy before enforcing it. What do you use?
Report-only mode (and the What If tool).
7. A disabled user's existing sessions must end within minutes, not hours. Which feature?
Continuous access evaluation.
8. Sign-ins from anonymous IPs or impossible travel must trigger MFA automatically. What do you configure?
A sign-in risk policy (ID Protection or Conditional Access).
9. Remote users need access to private apps without a traditional VPN. What do you deploy?
Microsoft Entra Private Access through Global Secure Access.
10. An Azure Function must read Key Vault secrets without storing credentials. What do you use?
A managed identity with access to Key Vault.
11. An on-premises web app must be published securely to remote users with Entra sign-in. What do you use?
Microsoft Entra Application Proxy.
12. Contractors should request project access, get manager approval and lose it after 90 days. What do you use?
An access package in entitlement management, with approval and expiration.
13. Group memberships must be confirmed by managers every quarter. What do you set up?
Recurring access reviews.
14. Admins should hold Global Administrator only when needed, with approval and MFA. What do you use?
Privileged Identity Management with an eligible assignment.
15. You need guaranteed admin access if Conditional Access or MFA breaks. What do you create?
Emergency access (break-glass) accounts excluded from those policies and closely monitored.
After SC-300
- Go further with the SC-200 SOC analyst guide or SC-500.
- Read AI, cloud and cyber security skills.
- See live security and identity jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches Microsoft Entra, Intune, Azure security and SOC operations with hands-on labs. See the APEX AI, ML, Cloud and Cyber Security program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
What certification does SC-300 earn?
Microsoft Certified: Identity and Access Administrator Associate.
What is the SC-300 passing score?
700.
Which SC-300 skill area has the most weight?
Implement authentication and access management, at 25–30%.
When were the SC-300 skills last updated?
The current skills measured apply as of 28 October 2026.
Does SC-300 need KQL and PowerShell?
Yes, at a working level: PowerShell for bulk operations and KQL for analysing sign-in and audit logs in Log Analytics.
How often must SC-300 be renewed?
Every year, with a free online renewal assessment on Microsoft Learn.
