Microsoft Certification
60 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Identity and Access Administrator (SC-300) certification validates professional expertise in Microsoft technologies. This study guide covers all 60 practice questions from our SC-300 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure Azure AD to require multi-factor authentication (MFA) for all users accessing sensitive applications. Which feature should you implement?
Conditional Access policies allow you to require MFA based on specific conditions such as user, application, or risk level. This is the recommended approach for implementing MFA requirements in Azure AD.
An organization wants to prevent users from registering personal devices for access to company resources. Which Azure AD feature should you configure?
Azure AD Device settings allow administrators to restrict who can register devices. You can limit device registration to specific groups or disable personal device registration entirely.
What is the primary purpose of using Role-Based Access Control (RBAC) in Azure AD?
RBAC allows administrators to assign permissions to users based on their job responsibilities and roles, following the principle of least privilege. This ensures users have only the access they need for their role.
You are configuring Azure AD B2B collaboration. A partner organization's user needs temporary access to your organization's resources for a specific project. What should you do?
Azure AD B2B guest invitations can be configured with access reviews and expiration dates. This ensures temporary access is automatically removed after the project completion, maintaining security.
Which Azure AD feature allows you to automatically revoke access to applications when a user's risk level becomes high?
Conditional Access policies can evaluate user risk factors detected by Azure AD Identity Protection and automatically block access or require MFA when risk levels exceed configured thresholds.
You need to grant a contractor access to a specific SharePoint site for 3 months. What is the best approach?
Azure AD B2B guest invitations with scheduled access reviews provide a secure, time-limited solution that automatically prompts administrators to verify continued access needs after the specified period.
What is the difference between Azure AD Application Proxy and VPN for providing remote access to on-premises applications?
Azure AD Application Proxy publishes on-premises applications through Azure AD, providing secure application-level access without exposing the entire network via VPN. Users access only the specific application with full Azure AD security controls.
You are implementing passwordless authentication in Azure AD. Which method is most suitable for organizations with many non-technical users?
Microsoft Authenticator with push notifications provides a user-friendly passwordless experience. Users simply approve sign-in requests on their phone, making it accessible to non-technical users without requiring specialized hardware.
Which Azure AD feature should you use to monitor and alert on suspicious sign-in activities?
Azure AD Identity Protection automatically detects and responds to suspicious sign-in activities by analyzing risk factors such as impossible travel, atypical sign-in properties, and leaked credentials, providing real-time alerts.
You need to implement app-level permissions and consent management in Azure AD. What should you configure?
Azure AD OAuth 2.0 permissions and consent policies allow administrators to control which applications can access user data and what permissions they require. This includes configuring admin consent workflows for sensitive permissions.
What is the primary benefit of using Managed Identities in Azure for applications?
Managed Identities automatically handle authentication for Azure resources, eliminating the need to store connection strings, API keys, or credentials in application code or configuration files.
You are configuring Azure AD to enforce that all users must use their company-issued devices to access sensitive data. What should you implement?
Conditional Access policies can require devices to be compliant or hybrid Azure AD joined before granting access to sensitive resources. This ensures only managed, secure devices can access sensitive data.
Which approach should you use when you need to audit who has access to sensitive resources and when those accesses occur?
Azure AD provides comprehensive audit logs and sign-in reports that show who accessed what resources and when. Access reviews allow administrators to regularly verify and certify that access is still appropriate.
You need to synchronize on-premises Active Directory user identities to Azure AD for hybrid scenarios. What is the recommended tool?
Azure AD Connect is the official Microsoft synchronization tool that securely replicates on-premises AD identities to Azure AD while supporting various authentication methods including password hash sync and pass-through authentication.
What is the primary advantage of using Azure AD Privileged Identity Management (PIM)?
Azure AD PIM enables just-in-time (JIT) privileged access, requiring approval for role activation and maintaining detailed audit logs. This limits standing administrative privileges and improves security posture.
You are implementing Azure AD B2C for a customer-facing application. What is the primary use case?
Azure AD B2C is designed for customer identity and access management (CIAM). It enables organizations to provide sign-up, sign-in, and profile management for external customers with flexible authentication options including social identities.
Which authentication method should you implement for users who require the highest level of security and cannot use biometric authentication?
FIDO2 security keys and hardware tokens provide the highest security level for authentication, using cryptographic proof of possession rather than secrets that can be phished or stolen.
What should you do when an employee leaves your organization to ensure security?
When an employee leaves, immediately disabling their account in Azure AD revokes their access to all connected services and invalidates active sessions. This should be part of a formal offboarding process.
You need to prevent users from using compromised passwords that have been exposed in known data breaches. What Azure AD feature should you implement?
Azure AD Password Protection validates passwords against a global list of known compromised passwords and allows administrators to add custom banned passwords. It blocks weak passwords at the time of password change or reset.
Which scenario is best suited for implementing Azure AD Application Proxy?
Application Proxy enables secure remote access to on-premises applications through Azure AD, applying conditional access policies and MFA without requiring VPN access to the internal network.
What is the purpose of Dynamic Groups in Azure AD?
Dynamic groups use membership rules based on user or device properties (department, location, etc.) to automatically add or remove members. This reduces administrative overhead and ensures consistent group membership policies.
You are designing a Zero Trust security model in Azure AD. Which principles should guide your implementation?
Zero Trust security requires verifying every access request through authentication and authorization, regardless of source. This includes conditional access, MFA, device compliance, and least privilege principles applied consistently.
What is the recommended approach for providing administrative access to Azure AD resources across multiple environments?
Azure AD PIM provides a secure administrative access model with just-in-time activation, approval workflows, and comprehensive audit trails. This implements the principle of least privilege and maintains security controls.
When implementing conditional access policies, what is the primary benefit of using location-based conditions?
Location-based conditional access policies can detect impossible travel, unusual sign-in locations, or access from high-risk geographic areas, triggering additional verification or blocking access to reduce the risk of account compromise.
You need to grant temporary access to an external consultant for a specific Azure resource. What is the best practice?
Azure AD B2B guest invitations combined with Azure role-based access control (RBAC) and time-limited assignments provide secure temporary access that automatically expires. Access reviews can verify continued need before expiration.
You are managing Azure AD identity governance for your organization. You need to implement a solution that automatically revokes access when an employee's role changes. Which feature should you configure?
Entitlement Management lifecycle workflows in Azure AD can automatically revoke or expire access based on changes in employment status or role, including when a user's role changes.
What is the primary purpose of Azure AD B2B collaboration?
Azure AD B2B collaboration allows external users to access your applications and resources while using their own identity credentials from their home organization.
Your organization needs to ensure that users cannot access company resources from untrusted networks. Which Azure AD feature would you implement?
Conditional Access policies in Azure AD can enforce controls based on network location, blocking access from untrusted or high-risk locations.
You are configuring self-service password reset (SSPR) for your Azure AD tenant. Which authentication method requires the least infrastructure investment?
Email-based OTP requires no additional infrastructure, hardware, or user enrollment beyond having an alternate email address on file, making it the least resource-intensive SSPR method.
When implementing Azure AD Application Proxy, what is required on the on-premises environment?
The Azure AD Application Proxy requires installation of lightweight connectors on-premises that establish outbound connections to Azure AD, eliminating the need for inbound firewall rules.
Your organization wants to prevent users from using the same password in Azure AD that they used in previous password changes. Which policy setting controls this?
Password history policy prevents users from reusing previous passwords by maintaining a count of the last N passwords that cannot be reused.
You need to audit which administrator accounts have accessed sensitive resources over the past 30 days. Where would you find this information?
Azure AD Sign-in logs provide detailed records of all user authentication attempts and can be filtered by user roles, including administrators, and specific time ranges.
Your company requires that all administrative actions in Azure AD be logged and reviewed. Which Azure AD feature provides this capability?
Azure AD Audit logs record all administrative actions and changes made within the tenant, providing a comprehensive trail of who did what and when.
You are implementing Privileged Identity Management (PIM) for your organization. What is the key benefit of using PIM for role activation?
PIM enforces just-in-time access by requiring administrators to request role activation with justification, undergo approval workflows, and receive time-limited permissions rather than permanent assignments.
When configuring Azure AD Connect with password hash synchronization, what is synchronized to Azure AD?
Password hash synchronization syncs a hash of the password hash (not the actual password), providing security by ensuring actual passwords never leave the on-premises environment.
Your organization uses Azure AD B2C for customer identity and access management. A customer reports they cannot reset their password. What is the most common cause?
Azure AD B2C requires explicit configuration and assignment of password reset user flows to applications; if not configured, users cannot access password reset functionality.
You need to implement a solution where users can sign in using their phone number instead of a username. Which Azure AD feature enables this?
Microsoft Authenticator app enables phone sign-in, allowing users to authenticate by receiving a notification and approving the sign-in on their registered phone device.
Your organization wants to implement a hybrid identity solution. What is the purpose of Azure AD Connect Sync?
Azure AD Connect Sync synchronizes user, group, and contact information from on-premises Active Directory to Azure AD, creating a hybrid identity infrastructure.
You are configuring dynamic groups in Azure AD. A user with the job title 'Manager' should automatically be added to a group. Which rule correctly achieves this?
Dynamic group membership rules use the correct syntax 'user.jobTitle -eq "Manager"' to automatically include users based on their job title attribute.
Your organization requires that sensitive applications can only be accessed during business hours (9 AM to 5 PM). Which Conditional Access control should you configure?
While Conditional Access doesn't have a built-in business hours control, time-based access can be enforced through session controls and app-enforced policies, or via custom solutions.
You want to provide single sign-on (SSO) to a third-party SaaS application. The application only supports SAML 2.0. What should you configure in Azure AD?
For SAML 2.0-compatible applications, you add the application from the Azure AD Gallery or as a non-gallery enterprise application and configure SAML-based single sign-on.
In Azure AD, what is the difference between a 'Role' and a 'Administrative Unit'?
Roles define what permissions an administrator has (e.g., User Administrator), while Administrative Units define the scope of resources (e.g., users in a specific department) that the role applies to.
You need to ensure that external users collaborating through Azure AD B2B cannot access resources beyond their designated projects. What should you implement?
Azure AD Entitlement Management allows you to create access packages and catalogs that limit what resources external B2B users can access and scope their permissions appropriately.
When a user completes Azure AD Multi-Factor Authentication, which information is stored to improve their sign-in experience?
Azure AD can track that MFA was completed on a device and, depending on policy, may skip MFA for subsequent sign-ins from that trusted device to improve user experience.
Your organization needs to grant temporary access to a contractor for a specific project. What is the best approach using Azure AD features?
Entitlement Management access packages with expiration dates provide an automated, governance-based approach to granting temporary access that automatically expires without manual intervention.
You are configuring Conditional Access and want to require users to accept Terms of Use (ToU) before accessing an application. What type of Conditional Access control is this?
Requiring Terms of Use acceptance is a Grant control in Conditional Access that mandates users acknowledge or accept Terms of Use before being granted access to a resource.
In Azure AD, what does the 'Compliance' status in a Conditional Access policy report indicate?
The Compliance status in Conditional Access reports shows whether a user's access attempt satisfied all conditions and controls (e.g., MFA completed, device compliant), determining if access was granted or denied.
Your organization wants to prevent users from using weak passwords such as 'Password123' or 'Admin@2024'. What Azure AD feature accomplishes this?
Azure AD Password Protection, including custom banned password lists, prevents users from creating accounts or changing passwords to commonly used or organizationally-specific weak passwords.
When implementing Azure AD Connect Health, what primary information does it monitor?
Azure AD Connect Health monitors the health and synchronization status of Azure AD Connect infrastructure, including sync services and on-premises federation servers, alerting to issues.
Your organization uses Azure AD with Windows 10 devices. You want to enable Windows Hello for Business to replace passwords. Which prerequisite is required?
Windows Hello for Business requires devices to be Azure AD joined or hybrid Azure AD joined; domain-only joined devices cannot use this passwordless sign-in method.
You need to configure a Conditional Access policy that requires multi-factor authentication when users sign in from outside the corporate network. Which location condition should you use?
Named locations in Conditional Access allow you to define trusted IP ranges and configure policies based on geographic location or network location, enabling MFA requirements for sign-ins from outside the corporate network.
Your organization uses hybrid identity with Azure AD Connect. You notice that password hash synchronization is not working. What is the most common cause?
The Azure AD Connect service account requires specific permissions (Replicating Directory Changes and Replicating Directory Changes All) to synchronize password hashes from on-premises AD to Azure AD.
You are implementing entitlement management to control access to resources. Which Azure AD feature allows you to create packages of access rights that users can request?
Access packages in Azure AD entitlement management are collections of resources and roles that users can request, and they can be assigned based on approval workflows and policies.
You need to prevent users from using weak passwords across your Azure AD tenant. Which approach should you implement?
Azure AD Password Protection evaluates passwords against a global banned password list and custom lists you define, preventing weak passwords like common dictionary words and patterns across your tenant.
An external partner needs temporary access to your organization's resources through B2B collaboration. What is the primary difference between B2B guest users and B2B direct connect?
B2B direct connect allows external users to access specific Teams channels and SharePoint sites without needing a guest account in your directory, while B2B guest collaboration creates a guest user account with broader access capabilities.
You want to ensure that when users request access to sensitive resources through entitlement management, the requests require approval from multiple managers. How should you configure this?
Access package approval policies allow you to configure approval stages with multiple approvers who must sequentially or simultaneously approve requests before access is granted.
You are troubleshooting application provisioning issues in Azure AD. An application shows 'In Progress' status for several users. What should you check first?
When provisioning is stuck 'In Progress', you should first check the connector health status and examine provisioning logs in Azure AD to identify specific errors preventing the provisioning operation from completing.
Your organization requires that users re-authenticate every 30 minutes when accessing critical applications. Which Azure AD feature should you implement?
Conditional Access sign-in frequency control allows you to require users to re-authenticate at specified intervals, such as every 30 minutes, for selected applications and conditions.
You are implementing a Zero Trust security model with Azure AD. Which combination of features best supports this architecture?
Zero Trust requires verifying every access request regardless of location; this is achieved through Conditional Access (device compliance, risk assessment), Identity Protection (real-time risk detection), and continuous re-evaluation of trust.
You need to create a custom role for application administrators who can manage app registrations but cannot grant admin consent. What should you do?
Custom Azure AD roles allow you to select specific granular permissions, enabling you to create roles that permit app registration management while explicitly excluding admin consent permissions.
You've reviewed all 60 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free