SC-300 · Domain 1 of 4

SC-300 Domain 1: Implement and manage user identities

Building the identity foundation in Microsoft Entra ID: tenant roles and administrative units, users, groups and licenses, B2B guests and cross-tenant settings, and hybrid synchronization with Entra Connect Sync or Cloud Sync.

Exam weight
20–25%
Official functional groups
4
Estimated questions estimate
~12
Suggested study time estimate
12–16 hrs

About 14 min read Reviewed October 2026

Overview

Domain 1 covers the objects every other SC-300 skill depends on. Microsoft splits it into four functional groups with 26 bullet objectives. The tenant group covers built-in and custom Microsoft Entra roles, administrative units, effective permissions, custom domains, company branding and tenant-wide user, group and device settings. The identities group covers users, groups, custom security attributes, bulk operations with the admin center and PowerShell, device join and registration, and license assignment.

The external group covers external collaboration settings, B2B invitations, guest account management, cross-tenant access settings, cross-tenant synchronization and external identity providers using SAML or WS-Fed. The hybrid group covers Microsoft Entra Connect Sync, Microsoft Entra Cloud Sync, password hash synchronization, pass-through authentication, seamless SSO, migration away from AD FS, and Connect Health. SC-300 remains active as of October 2026, and Microsoft refreshed its skills list on October 28, 2026.

How it's tested

Questions in this area usually describe an organization with a tenant, some on-premises directories or partner companies, and an administrative requirement. You choose the role and scope, the group type, the guest or cross-tenant setting, or the sync and sign-in method that meets the constraint with the least privilege or administrative effort.

  • Narrowest admin scope

    A regional helpdesk must reset passwords only for its own users, and you pick a built-in role assigned at an administrative unit.

  • Partner access design

    A partner tenant needs access, and you choose between B2B invitations, cross-tenant access settings, B2B direct connect or cross-tenant synchronization.

  • Hybrid sign-in choice

    Constraints such as on-premises password policy enforcement or no on-premises agents decide between hash sync, pass-through authentication and federation.

Reasoning it through

A company with three disconnected AD forests after an acquisition wants to sync users to one tenant with minimal on-premises infrastructure. Connect Sync supports disconnected forests only with more complex topologies, while Cloud Sync uses lightweight provisioning agents managed from the cloud and handles disconnected forests natively. If the scenario adds a need for device writeback or complex custom sync rules, Connect Sync becomes the answer instead, so read every constraint before choosing.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

1.1 Configure and manage a Microsoft Entra tenantRoles, administrative units, effective permissions, domains, branding and tenant settings.
What it means
This group covers assigning built-in and custom Microsoft Entra roles, deciding when administrative units help and configuring them, evaluating the effective permissions a user gets from several role assignments, adding and verifying custom domains in Entra ID and Microsoft 365, configuring company branding, and setting tenant properties plus user, group and device settings.
What to understand
Microsoft Entra roles control directory objects, while Azure RBAC roles control Azure resources; the two systems are separate. Roles can be assigned at tenant scope, at an administrative unit, or on a single object such as an app registration. Administrative units limit which users, groups or devices a role holder can manage, and restricted management administrative units stop even tenant-wide admins from changing members unless they hold a role scoped to that unit. Custom roles are built from granular permissions and are mainly available for app and some user management actions. Effective permissions are the union of every assignment, so check all of them. Domain verification uses a TXT or MX record, and a federated domain cannot simply be removed while users depend on it.
How it shows up
Expect least-privilege role selection for a helpdesk, regional admin or app owner, and questions on how to stop users creating tenants or registering apps.
Common confusion
Assigning User Administrator tenant-wide when Helpdesk Administrator scoped to an administrative unit is enough.
1.2 Create, configure, and manage Microsoft Entra identitiesUsers, groups, custom security attributes, bulk work, devices and licenses.
What it means
This group covers creating and managing user accounts and groups, managing custom security attributes, automating bulk changes in the Microsoft Entra admin center and with Microsoft Graph PowerShell, managing device join and registration, and assigning, changing and reporting on licenses.
What to understand
Security groups grant access, while Microsoft 365 groups add shared mailbox, calendar and Teams resources. Membership can be assigned or dynamic, and dynamic rules on user or device attributes need Microsoft Entra ID P1 licensing for the users in scope. Role-assignable groups must be set at creation and cannot use dynamic membership. Custom security attributes hold sensitive key-value data and need the Attribute Assignment or Attribute Definition roles, not Global Administrator alone. Group-based licensing assigns licenses automatically and reports errors such as conflicting service plans or a usage location where a service is not available. For devices, know the difference between Entra registered, Entra joined and hybrid joined, plus settings like who may join devices and the local administrator assignment.
How it shows up
Expect a dynamic rule to write, a group type choice, a license error to fix, or a device identity state to identify.
Common confusion
Expecting a role-assignable group to support dynamic membership or to be converted later.
1.3 Implement and manage identities for external users and tenantsExternal collaboration, guest invitations, cross-tenant access and sync, and external IdPs.
What it means
This group covers external collaboration settings such as who can invite guests and which domains are allowed, inviting external users individually or in bulk, managing guest accounts, configuring cross-tenant access settings, implementing cross-tenant synchronization, and setting up external identity providers that use SAML or WS-Fed federation.
What to understand
External collaboration settings control guest user permissions, who can send invitations, and allow or deny lists for domains. Cross-tenant access settings work per partner organization with inbound and outbound rules for B2B collaboration and B2B direct connect, plus trust settings that accept the partner's MFA and compliant-device claims so guests are not prompted twice. B2B direct connect powers Teams shared channels without creating a guest object. Cross-tenant synchronization automates creation of B2B users from a source tenant into a target tenant, which suits multi-tenant organizations. SAML or WS-Fed identity provider federation lets guests sign in with their own IdP when their organization does not use Entra ID.
How it shows up
Expect a partner scenario asking how to avoid double MFA prompts, enable shared channels, or automate guest creation across a multi-tenant organization.
Common confusion
Mixing up B2B direct connect, which creates no guest account, with B2B collaboration, which does.
1.4 Implement and manage hybrid identityConnect Sync, Cloud Sync, hash sync, pass-through auth, seamless SSO, AD FS migration and Connect Health.
What it means
This group covers installing and operating Microsoft Entra Connect Sync and Microsoft Entra Cloud Sync, implementing password hash synchronization and pass-through authentication, enabling seamless single sign-on, migrating applications and domains from AD FS to cloud authentication, and monitoring the sync infrastructure with Microsoft Entra Connect Health.
What to understand
Connect Sync is a full server-based sync engine supporting complex rules, device writeback and Exchange hybrid writeback, while Cloud Sync uses lightweight agents, supports disconnected forests and is configured from the cloud. Microsoft recommends Cloud Sync where its features are enough. Password hash sync stores a hash of the hash in the cloud and also enables leaked credential detection in ID Protection. Pass-through authentication validates passwords against on-premises DCs through agents, so on-premises password policy and logon hours apply in real time. Seamless SSO uses a computer account and Kerberos for domain-joined devices on the corporate network. Migrating from AD FS usually means staged rollout to move groups to cloud authentication before converting the domain from federated to managed.
How it shows up
Expect method selection from business constraints, troubleshooting sync errors, and a staged AD FS migration plan.
Common confusion
Thinking pass-through authentication stores password hashes in the cloud; it does not unless hash sync is also enabled as a backup.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Administrative unit

    A container that limits the scope of a role assignment to a set of users, groups or devices.

    Remember
    Assign scoped roles such as Helpdesk Administrator to the unit.
    Tested as
    Least-privilege delegation questions.
    Trap
    Using a group as a role scope boundary instead.

  • Restricted management administrative unit

    An administrative unit whose members can be changed only by admins scoped to that unit.

    Remember
    Even Global Administrators cannot edit members at tenant scope.
    Tested as
    Protecting executives or sensitive accounts.
    Trap
    Assuming tenant-wide admins keep full control.

  • Role-assignable group

    A group that can receive Microsoft Entra role assignments.

    Remember
    Set at creation, assigned membership only.
    Tested as
    PIM for Groups and delegation scenarios.
    Trap
    Trying to make it dynamic.

  • Dynamic membership rule

    A rule on user or device attributes that adds and removes members automatically.

    Remember
    Requires Entra ID P1 for users in scope.
    Tested as
    Automated group design.
    Trap
    Expecting instant membership updates after attribute changes.

  • Custom security attributes

    Business-defined key-value attributes for users and apps with their own permission model.

    Remember
    Global Administrator cannot read them by default.
    Tested as
    ABAC and app filtering questions.
    Trap
    Assigning Global Administrator to manage them.

  • Group-based licensing

    Assigning licenses to a group so members inherit them.

    Remember
    Users without a usage location inherit the tenant country; errors come from conflicting plans or unavailable locations.
    Tested as
    License error troubleshooting.
    Trap
    Assigning licenses user by user at scale.

  • Cross-tenant access settings

    Per-organization inbound and outbound rules plus trust settings for MFA and device claims.

    Remember
    Trusting partner MFA prevents double prompts.
    Tested as
    Partner collaboration questions.
    Trap
    Changing external collaboration settings instead.

  • B2B direct connect

    Mutual trust that lets users from another Entra tenant access Teams shared channels.

    Remember
    No guest object is created.
    Tested as
    Shared channel scenarios.
    Trap
    Expecting guests in the directory.

  • Cross-tenant synchronization

    Automated provisioning of B2B users from a source tenant into target tenants.

    Remember
    Configured in the source tenant with an inbound allow in the target.
    Tested as
    Multi-tenant organization questions.
    Trap
    Inviting users in bulk with a CSV instead.

  • Cloud Sync

    Agent-based sync configured from the cloud.

    Remember
    Supports disconnected forests and high availability with several agents.
    Tested as
    Hybrid design choices.
    Trap
    Choosing it when device writeback is required.

  • Pass-through authentication

    Cloud sign-ins validated by on-premises agents against Active Directory.

    Remember
    Enforces on-premises account states immediately.
    Tested as
    Hybrid sign-in questions.
    Trap
    Expecting it to work if all agents are down.

  • Staged rollout

    Moving selected groups from federated to cloud authentication before a full cutover.

    Remember
    Used for AD FS migration testing.
    Tested as
    Migration planning questions.
    Trap
    Converting the whole domain first.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Hybrid sign-in methods

ConceptMeaningKey differenceCommon trap
Password hash synchronization Hash of the password hash synced to Entra ID No on-premises dependency at sign-in and enables leaked credential detection Believing the actual password is stored in the cloud
Pass-through authentication Agents validate passwords against on-premises AD On-premises policies apply in real time Ignoring agent availability
Federation with AD FS Sign-in redirected to an on-premises federation service Most infrastructure; Microsoft recommends migrating away Keeping it only for features cloud auth now provides

External access options

ConceptMeaningKey differenceCommon trap
B2B collaboration Guest user object in your tenant Works with any email or IdP Assuming guests need a full license
B2B direct connect Trust with another Entra tenant for shared channels No guest object created Expecting general app access
Cross-tenant synchronization Automated B2B user provisioning between tenants Lifecycle handled automatically Using it for one-off partner invitations

Sync engines

ConceptMeaningKey differenceCommon trap
Microsoft Entra Connect Sync Server-based sync engine with full rule editor Supports device and Exchange hybrid writeback Overlooking the staging server for resilience
Microsoft Entra Cloud Sync Lightweight agents configured from the cloud Handles disconnected forests simply Choosing it for features it lacks

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Global Administrator for everything

    What candidates pick
    Assign Global Administrator so the regional helpdesk can reset passwords.
    Why it looks right
    It always works.
    Why it's wrong
    It breaks least privilege; Helpdesk or Password Administrator scoped to an administrative unit meets the need.

    Clue to watch for The requirement mentions a region, department or least privilege.

  2. Azure RBAC for directory tasks

    What candidates pick
    Grant Owner on the subscription to manage users.
    Why it looks right
    Owner sounds powerful.
    Why it's wrong
    Azure RBAC governs Azure resources, while directory objects need Microsoft Entra roles.

    Clue to watch for The task is about users, groups or apps in the directory.

  3. Guest for shared channels

    What candidates pick
    Invite partner users as guests for Teams shared channels.
    Why it looks right
    Guests are the familiar B2B pattern.
    Why it's wrong
    Shared channels rely on B2B direct connect configured in cross-tenant access settings, not guest accounts.

    Clue to watch for The scenario names Teams shared channels.

  4. Pass-through for cloud resilience

    What candidates pick
    Choose pass-through authentication so sign-in works when the data center is offline.
    Why it looks right
    It avoids storing hashes.
    Why it's wrong
    Pass-through authentication fails when agents cannot reach domain controllers; password hash sync keeps cloud sign-in working.

    Clue to watch for Resilience or disaster recovery is the stated goal.

  5. Bulk CSV for multi-tenant sync

    What candidates pick
    Bulk invite users from the other tenant every month.
    Why it looks right
    Bulk invitations are documented.
    Why it's wrong
    Cross-tenant synchronization provisions and deprovisions users automatically, which a CSV import cannot do.

    Clue to watch for Both tenants belong to the same organization and change constantly.

  6. Dynamic role-assignable group

    What candidates pick
    Create a dynamic group and assign a Microsoft Entra role to it.
    Why it looks right
    It seems efficient.
    Why it's wrong
    Role-assignable groups only support assigned membership to prevent privilege escalation through attribute changes.

    Clue to watch for The group will hold a directory role.

Answer framework

Apply these steps to user identity scenarios in Domain 1.

  1. Identify the object type and its source: cloud user, synced user, guest, device or group, and whether Active Directory remains authoritative.
  2. For delegation, pick the narrowest built-in Microsoft Entra role, then scope it to an administrative unit or single object instead of the tenant.
  3. For groups and licensing, choose security or Microsoft 365, assigned or dynamic, and check usage location and role-assignable needs before creation.
  4. For partners, decide between B2B collaboration, direct connect or cross-tenant synchronization, and set per-organization inbound, outbound and trust settings.
  5. For hybrid, match Connect Sync or Cloud Sync to forest layout and writeback needs, then choose hash sync, pass-through or a staged move off AD FS.

Practice question

A company runs AD FS for sign-in to Microsoft Entra ID and wants to retire it. Leadership requires that a small pilot group of users switch to cloud authentication first, with no change for other users until the pilot succeeds. What should the administrator configure first?

Want more like this? The SC-300 practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with a free developer or trial tenant and add Microsoft Entra ID P2 trial licenses so dynamic groups, administrative units and later governance features all work. Create a few departments of users with Microsoft Graph PowerShell, build dynamic groups on department attributes, and watch group-based licensing apply. Then create administrative units, assign Helpdesk Administrator to one, and sign in as that admin to confirm what can and cannot be changed.

For external identities, a second trial tenant pays off. Configure cross-tenant access with MFA trust, test a guest invitation, and set up cross-tenant synchronization in one direction. Note where each setting lives in the admin center, because the exam often asks which blade or setting to change.

Hybrid identity is hard to lab fully, so pair a small Windows Server VM running AD DS and Cloud Sync with careful reading of the Microsoft Learn decision guides for authentication methods and sync tools. Memorize the trade-offs in the comparison table above, then practice scenario questions until you can name the method from two or three constraints.

FAQ

How much of SC-300 is Domain 1, Implement and manage user identities?

Microsoft weights Implement and manage user identities at 20–25% of the exam. It has four functional groups: tenant configuration, identities, external users and tenants, and hybrid identity.

Is SC-300 being retired?

No retirement was announced as of October 31, 2026. Microsoft updated the skills measured on October 28, 2026 with minor changes, so study from the current study guide.

Do I need to know PowerShell for SC-300?

Yes, at a practical level. The objectives name bulk operations with PowerShell, so know common Microsoft Graph PowerShell tasks such as creating users, setting licenses and managing group membership.

Which licence is needed for dynamic groups?

Dynamic membership rules require Microsoft Entra ID P1 or higher for each user who is a member of a dynamic group.

What is the difference between Entra joined and Entra registered devices?

Joined devices are owned by the organization and sign in with Entra accounts. Registered devices are usually personal devices where a work account is added for access to resources.

Should I study AD FS in depth?

Focus on migrating away from it. Know staged rollout, the prerequisites for cloud authentication, and how to convert a federated domain to managed once testing is done.

What does Connect Health monitor?

Microsoft Entra Connect Health monitors sync servers, AD FS servers and AD DS domain controllers, raising alerts and showing usage and performance data in the admin center.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered tenant roles, administrative units, users and groups, external identities and hybrid sync. Check whether you can choose the right scope and sync design under exam conditions.

Take the SC-300 practice test Check your SC-300 readiness

Keep going