SC-300 study guide · 2026

The 4 SC-300 domains, explained

4 domains and 16 official functional groups. Implement authentication and access management carries the most weight at 25–30%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 2 See all domains
Questions
Not published
Time
100 minutes
Passing score
700 / 1000
Outline
SC-300 study guide, skills measured as of October 28, 2026 (current)

Exam blueprint

Bar widths follow the official weights, scaled to fit the bar. Weight ranges are drawn at their midpoint.

  1. 1 20–25%
  2. 2 25–30%
  3. 3 20–25%
  4. 4 20–25%
  1. 1 Implement and manage user identities
  2. 2 Implement authentication and access management
  3. 3 Plan and implement workload identities
  4. 4 Plan and automate identity governance

All 4 domains

16 official functional groups 52–68 hrs suggested study

  1. Domain 01 20–25%

    Implement and manage user identities

    Building the identity foundation in Microsoft Entra ID: tenant roles and administrative units, users, groups and licenses, B2B guests and cross-tenant settings, and hybrid synchronization with Entra Connect Sync or Cloud Sync.

    Inside this domain

    • Configure and manage a Microsoft Entra tenant
    • Create, configure, and manage Microsoft Entra identities
    • Implement and manage identities for external users and tenants
    • Implement and manage hybrid identity

    Watch for Global Administrator for everything

    Functional groups
    4
    Questions est.
    ~12
    Study time est.
    12–16 hrs
  2. Domain 02 25–30%

    Implement authentication and access management

    Controlling how users prove who they are and when they get in: authentication methods and SSPR, Conditional Access design and troubleshooting, risk-based policies in Microsoft Entra ID Protection, and Global Secure Access for private apps and internet traffic.

    Inside this domain

    • Plan, implement, and manage Microsoft Entra user authentication
    • Plan, implement, and manage Microsoft Entra Conditional Access
    • Manage risk by using Microsoft Entra ID Protection
    • Implement Global Secure Access

    Watch for Require MFA is enough

    Functional groups
    4
    Questions est.
    ~14
    Study time est.
    16–20 hrs
  3. Domain 03 20–25%

    Plan and implement workload identities

    Giving applications and Azure workloads the right identities and access: managed identities, enterprise app settings and consent, application proxy and SaaS integration, app registrations with permissions and roles, and monitoring app use with Microsoft Defender for Cloud Apps.

    Inside this domain

    • Plan and implement identities for applications and Azure workloads
    • Plan, implement, and monitor the integration of enterprise applications
    • Plan and implement app registrations
    • Manage and monitor app access by using Microsoft Defender for Cloud Apps

    Watch for Service principal secret for Azure workloads

    Functional groups
    4
    Questions est.
    ~12
    Study time est.
    12–16 hrs
  4. Domain 04 20–25%

    Plan and automate identity governance

    Controlling who keeps access over time: entitlement management with catalogs and access packages, access reviews, Privileged Identity Management for roles, Azure resources and groups, emergency access accounts, and monitoring identity activity with logs, KQL, workbooks and Identity Secure Score.

    Inside this domain

    • Plan and implement entitlement management in Microsoft Entra
    • Plan, implement, and manage access reviews in Microsoft Entra
    • Plan and implement privileged access
    • Monitor identity activity by using logs, workbooks, and reports

    Watch for Manual guest cleanup

    Functional groups
    4
    Questions est.
    ~12
    Study time est.
    12–16 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 52–68 hrs of study.

  1. 2 Implement authentication and access management 25–30% · 16–20 hrs
  2. 1 Implement and manage user identities 20–25% · 12–16 hrs
  3. 3 Plan and implement workload identities 20–25% · 12–16 hrs
  4. 4 Plan and automate identity governance 20–25% · 12–16 hrs

Try one

Practice questionDomain 2: Implement authentication and access management

Users report they were not prompted for MFA when accessing a SharePoint site labeled as highly confidential, although a policy requires MFA for that content. The policy targets an authentication context. Which tool lets the administrator see which Conditional Access policies applied to a past failed or successful sign-in?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Global Administrator for everything

    Clue The requirement mentions a region, department or least privilege.

  • Domain 2

    Require MFA is enough

    Clue The requirement says phishing-resistant or passwordless.

  • Domain 3

    Service principal secret for Azure workloads

    Clue The workload runs on an Azure resource that supports managed identities.

  • Domain 4

    Manual guest cleanup

    Clue The scenario asks for automatic removal with least administrative effort.

Other Cybersecurity certifications

Study guides for exams that overlap with SC-300.

Practise what you read

SC-300 domains: common questions

How many domains are in the SC-300 exam?

SC-300 has 4 domains with 16 official functional groups between them: Implement and manage user identities, Implement authentication and access management, Plan and implement workload identities and Plan and automate identity governance.

Which SC-300 domain carries the most weight?

Implement authentication and access management is the heaviest at 25–30%, followed by Implement and manage user identities (20–25%). The lightest is Plan and automate identity governance (20–25%). Weights come from Microsoft's official outline.

What is the SC-300 exam format?

Questions: Not published. Time allowed: 100 minutes. Passing score: 700 / 1000.

How long should I study for SC-300?

Our planning estimate is 52–68 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Implement authentication and access management, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows SC-300 study guide, skills measured as of October 28, 2026 (current), published by Microsoft. It was last reviewed in October 2026.

Domain names, weights and functional groups come from Microsoft's official outline (SC-300 study guide, skills measured as of October 28, 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.