SC-300 Tests Least-Privilege Entra Configuration Choices — Not Turning Every Feature On
SC-300 is for admins who run Microsoft Entra day to day. Scenarios name who, which app, from where and at what risk; the shift is choosing the narrowest scope and the setting that actually enforces the outcome.
Check Your Readiness →Most candidates understand Microsoft Identity and Access Administrator (SC-300) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Microsoft's study guide shows 25–30% for authentication in its summary but 20–25% in the section heading; the summary figure is used here. Items are configuration scenarios where several settings exist and only one meets the constraint with least privilege or effort. 700/1000 to pass in 100 minutes.
Convert the federated domain to managed for everyone
Enable password hash sync, then use staged rollout to move selected groups from federation to cloud authentication. Other users keep AD FS until the pilot succeeds, after which the domain converts and AD FS can be decommissioned.
Enable the policy immediately for all users
Exclude two cloud-only emergency access accounts, run the policy in report-only mode against real sign-ins, and use What If to simulate specific conditions. Every matching policy applies, so check combined effects, not just the first match.
Use cloud discovery to block downloads from the app
Route the app through Conditional Access app control with a session control, then create a Defender for Cloud Apps session policy blocking downloads from unmanaged devices. Discovery only analyses logs for visibility and cannot act in-session.
Create an app registration with a client secret
Enable a managed identity on the VM and grant it the narrowest Key Vault RBAC role. Choose user-assigned if several resources share access or redeploy often. A managed identity with no role assignment can authenticate but reach nothing.
Script a quarterly deletion of inactive guest accounts
Create a catalog and access package, add the partner as a connected organization so users can request without invitation, and set expiration plus external user lifecycle removal. Schedule access reviews with auto apply enabled.
A regional helpdesk needs Helpdesk or Password Administrator scoped to an administrative unit, not Global Administrator. Restricted management administrative units go further: members can be changed only by admins scoped to that unit, even tenant-level Global Administrators cannot.
Role-assignable is set at creation and supports assigned membership only, so attribute edits cannot escalate privilege. Dynamic membership rules need Entra ID P1 and do not update instantly after attribute changes.
SMS and voice satisfy the Require multifactor authentication grant. Use the built-in phishing-resistant MFA authentication strength, with passkeys (FIDO2) enabled in the Authentication methods policy and a Temporary Access Pass for onboarding or recovery.
Sign-in risk is about one authentication, so require MFA. User risk means the account may be compromised, such as leaked credentials, so require a secure password change. Build both as risk-based Conditional Access policies rather than legacy ID Protection policies.
Diagnostic settings route logs to Log Analytics for KQL, workbooks and alerts; storage accounts archive only; Event Hubs feed a third-party SIEM. Admin center retention is too short for annual audits. Interactive sign-ins land in the SigninLogs table, not AuditLogs.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
SC-300 rewards the narrowest scope that still enforces the requirement. Check your Entra decisions.