SC-300 · Domain 2 of 4

SC-300 Domain 2: Implement authentication and access management

Controlling how users prove who they are and when they get in: authentication methods and SSPR, Conditional Access design and troubleshooting, risk-based policies in Microsoft Entra ID Protection, and Global Secure Access for private apps and internet traffic.

Exam weight estimate
25–30%
Official functional groups
4
Estimated questions estimate
~14
Suggested study time estimate
16–20 hrs

About 14 min read Reviewed October 2026

Overview

Domain 2 is the heaviest SC-300 skill area and has four functional groups with 27 bullet objectives. User authentication covers planning, authentication methods such as certificate-based authentication, Temporary Access Pass, Microsoft Authenticator and passkeys (FIDO2), tenant-wide MFA settings, SSPR, Windows Hello for Business, revoking sessions, password protection and Microsoft Entra Kerberos for hybrid identities.

Conditional Access covers planning policies, assignments and controls, testing with What If and report-only mode, session management, device-enforced restrictions, continuous access evaluation, authentication context, protected actions and policy templates. The ID Protection group covers user risk, sign-in risk, MFA registration and campaigns, and investigating risky users, sign-ins and workload identities. The final group covers Global Secure Access clients, Microsoft Entra Private Access, Microsoft Entra Internet Access and the Microsoft traffic profile for Microsoft 365.

How it's tested

Expect scenarios that state who should be affected, from where, on which app, and under what risk, followed by a required outcome such as phishing-resistant MFA or blocking legacy authentication. You build or fix a policy, choose an authentication method, or decide which Global Secure Access profile carries the traffic.

  • Read the policy

    Several Conditional Access policies apply to a sign-in, and you predict the result or find why a user was blocked or not prompted.

  • Pick the method

    A user group needs passwordless or phishing-resistant sign-in, or a new hire needs onboarding without a password, and you choose the method.

  • Risk response

    Leaked credentials or impossible travel is detected, and you choose the risk policy, remediation and who can self-remediate.

Reasoning it through

An organization wants admins to use phishing-resistant MFA whenever they activate a privileged role, without forcing it on every sign-in. Requiring passkeys for all apps is too broad. The fit is an authentication context tagged in PIM role settings, with a Conditional Access policy that targets that context and requires the phishing-resistant authentication strength. Activation then triggers a step-up, while routine sign-ins follow the normal baseline policy.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Plan, implement, and manage Microsoft Entra user authenticationAuthentication methods, MFA settings, SSPR, Windows Hello, session revocation, password protection and Entra Kerberos.
What it means
This group covers planning authentication, enabling methods such as certificate-based authentication, Temporary Access Pass, Microsoft Authenticator and passkeys (FIDO2), configuring tenant-wide MFA settings, deploying SSPR, implementing Windows Hello for Business, disabling accounts and revoking sessions, configuring Microsoft Entra password protection, and enabling Microsoft Entra Kerberos authentication for hybrid identities.
What to understand
The Authentication methods policy decides which methods users can register and use, and it can target groups per method. Phishing-resistant methods are passkeys (FIDO2 security keys or passkeys in Authenticator), Windows Hello for Business and certificate-based authentication. Temporary Access Pass is a time-limited code for onboarding or recovery that lets users register passwordless methods. SSPR needs a scope, the number of required methods and, for hybrid users, password writeback. Password protection blocks weak and custom banned passwords in the cloud and on-premises through DC agents. Revoking sessions invalidates refresh tokens, though access tokens remain valid until expiry unless continuous access evaluation applies. Entra Kerberos supports Windows Hello cloud Kerberos trust and access to on-premises resources.
How it shows up
Expect method selection for a security requirement, SSPR writeback troubleshooting, and a compromised-account response sequence.
Common confusion
Treating SMS or voice as phishing-resistant, or thinking disabling an account instantly kills every existing access token.
2.2 Plan, implement, and manage Microsoft Entra Conditional AccessPolicy planning, assignments, controls, testing, session management, CAE, authentication context and protected actions.
What it means
This group covers planning Conditional Access, setting assignments for users, target resources and conditions, configuring grant and session controls, testing and troubleshooting with What If and report-only mode, session management such as sign-in frequency, device-enforced restrictions, continuous access evaluation, authentication context, protected actions, and creating policies from templates.
What to understand
Every matching policy applies, and all their grant requirements must be met; any block wins. Assignments combine users, target resources, network and device conditions, client apps and risk. Grant controls include MFA, authentication strengths, compliant or hybrid joined device, approved client app and terms of use. Session controls cover sign-in frequency, persistent browser, app-enforced restrictions and Conditional Access app control. Continuous access evaluation lets supporting services reject tokens in near real time after critical events such as password change or location change. Authentication context labels sensitive actions or SharePoint sites for step-up, and protected actions apply that context to specific admin operations such as deleting Conditional Access policies. Always exclude emergency access accounts.
How it shows up
Expect policy outcome prediction, sign-in log troubleshooting, and choosing session controls or authentication strength for a stated requirement.
Common confusion
Believing the first matching policy wins; Conditional Access combines every policy that applies.
2.3 Manage risk by using Microsoft Entra ID ProtectionUser risk, sign-in risk, MFA registration, investigation and risky workload identities.
What it means
This group covers configuring user risk and sign-in risk responses through ID Protection or risk-based Conditional Access, driving MFA registration with authentication methods settings and registration campaigns, and monitoring, investigating and remediating risky users, risky sign-ins and risky workload identities.
What to understand
Sign-in risk is the probability that a specific authentication was not made by the account owner, such as an anonymous IP address or token anomaly. User risk is the probability that the account is compromised, from detections such as leaked credentials. Microsoft recommends configuring risk responses as Conditional Access policies rather than the legacy ID Protection policies. Typical responses are MFA for sign-in risk and secure password change for user risk, with self-remediation needing registered MFA. Admins can confirm compromise, confirm safe, dismiss risk or reset passwords. Registration campaigns nudge users toward Microsoft Authenticator. Workload identity risk covers service principals with detections such as leaked credentials, and needs Workload ID premium licensing.
How it shows up
Expect matching the risk type to a detection, choosing remediation, and fixing why users cannot self-remediate.
Common confusion
Requiring password change for sign-in risk, or forgetting that users without registered MFA cannot self-remediate.
2.4 Implement Global Secure AccessClients, Private Access, Internet Access and the Microsoft traffic profile.
What it means
This group covers deploying Global Secure Access clients to devices, deploying and managing Microsoft Entra Private Access for private apps, deploying and managing Microsoft Entra Internet Access for public web traffic, and enabling the Microsoft traffic profile that secures traffic to Microsoft 365 services.
What to understand
Global Secure Access is Microsoft's security service edge and identity-centric network access solution. Traffic forwarding profiles decide what the client tunnels: the Microsoft traffic profile for Microsoft 365, the Private Access profile for internal apps, and the Internet Access profile for other web traffic. Private Access replaces broad VPN access with per-app access through private network connectors, and applications can be configured as Quick Access or as individual enterprise apps that Conditional Access can target. Internet Access adds web content filtering policies linked through security profiles. The client runs on Windows, macOS, iOS and Android, and features such as source IP restoration and compliant network checks tie network location back into Conditional Access.
How it shows up
Expect a requirement to replace VPN, filter web categories, or restrict Microsoft 365 to a compliant network, and you pick the profile or component.
Common confusion
Confusing Private Access connectors with the Microsoft traffic profile, which needs no connector.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Authentication methods policy

    Central policy controlling which methods users can register and use.

    Remember
    Replaces the legacy MFA and SSPR method settings.
    Tested as
    Method enablement questions.
    Trap
    Changing the legacy per-user MFA page instead.

  • Authentication strength

    A Conditional Access grant control naming allowed method combinations.

    Remember
    Built-in phishing-resistant MFA strength exists.
    Tested as
    Admin and high-risk app policies.
    Trap
    Using plain Require MFA when phishing resistance is needed.

  • Temporary Access Pass

    Time-limited passcode used to onboard or recover passwordless methods.

    Remember
    Can be one-time use.
    Tested as
    New hire and lost device scenarios.
    Trap
    Treating it as a long-term sign-in method.

  • Passkeys (FIDO2)

    Phishing-resistant credentials on security keys or in Microsoft Authenticator.

    Remember
    Enabled in the Authentication methods policy.
    Tested as
    Passwordless questions.
    Trap
    Assuming SMS is equally strong.

  • SSPR password writeback

    Writes cloud password resets back to on-premises AD.

    Remember
    Needed for synced users to use SSPR.
    Tested as
    Hybrid SSPR troubleshooting.
    Trap
    Forgetting to enable it in the sync tool.

  • Report-only mode

    Evaluates a Conditional Access policy and logs the result without enforcing it.

    Remember
    Use before turning a policy on.
    Tested as
    Safe rollout questions.
    Trap
    Expecting What If to use live traffic.

  • What If tool

    Simulates which policies would apply to a given sign-in.

    Remember
    Test conditions before go-live.
    Tested as
    Troubleshooting questions.
    Trap
    Thinking it changes policies.

  • Continuous access evaluation

    Near real-time token revocation in supporting apps after critical events.

    Remember
    Strict location enforcement is an option.
    Tested as
    Session revocation questions.
    Trap
    Assuming every app supports it.

  • Authentication context

    A tag that triggers step-up Conditional Access for sensitive resources or actions.

    Remember
    Used by PIM, SharePoint and protected actions.
    Tested as
    Step-up authentication questions.
    Trap
    Creating a separate app for each sensitive action.

  • Protected actions

    Admin operations that require a Conditional Access authentication context.

    Remember
    Example: deleting Conditional Access policies.
    Tested as
    Admin hardening questions.
    Trap
    Using PIM alone to add step-up.

  • Sign-in risk vs user risk

    Risk of one authentication versus risk the account is compromised.

    Remember
    MFA for sign-in risk, secure password change for user risk.
    Tested as
    Risk policy questions.
    Trap
    Swapping the remediations.

  • Traffic forwarding profiles

    Global Secure Access settings choosing which traffic the client tunnels.

    Remember
    Microsoft, Private Access and Internet Access profiles.
    Tested as
    Global Secure Access design.
    Trap
    Expecting one profile to cover all traffic.

  • Private network connector

    Lightweight agent publishing internal apps for Entra Private Access.

    Remember
    Same connector family as application proxy.
    Tested as
    VPN replacement questions.
    Trap
    Opening inbound firewall ports.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Risk types

ConceptMeaningKey differenceCommon trap
Sign-in risk Likelihood that one sign-in is not from the owner Evaluated in real time or offline per sign-in Remediating with a password reset
User risk Likelihood the identity is compromised Accumulates from detections like leaked credentials Using MFA alone to clear it
Workload identity risk Risk on service principals Needs Workload ID premium Applying user risk policies to apps

Conditional Access testing

ConceptMeaningKey differenceCommon trap
What If Simulates a sign-in against current policies No real sign-in needed Expecting it to show report-only results
Report-only mode Policy logs results without enforcing Uses real sign-ins Forgetting to switch it on later
Sign-in logs Records which policies applied and why Investigates past failures Reading only the audit log

Global Secure Access profiles

ConceptMeaningKey differenceCommon trap
Microsoft traffic profile Tunnels Microsoft 365 traffic No connector required Using it for internal apps
Private Access profile Tunnels traffic to internal apps via connectors Replaces legacy VPN Skipping connector deployment
Internet Access profile Tunnels public web traffic for filtering Web content filtering policies apply Expecting it to protect private apps

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Require MFA is enough

    What candidates pick
    Use the Require multifactor authentication grant for admins.
    Why it looks right
    It is the familiar control.
    Why it's wrong
    SMS and voice satisfy it, so a phishing-resistant authentication strength is needed when the scenario demands phishing resistance.

    Clue to watch for The requirement says phishing-resistant or passwordless.

  2. Turn it straight on

    What candidates pick
    Enable a new block policy immediately for all users.
    Why it looks right
    It meets the goal fastest.
    Why it's wrong
    Untested policies can lock out the organization; report-only mode and an excluded break-glass account come first.

    Clue to watch for The scenario mentions minimizing disruption or validating impact.

  3. Revoke equals instant

    What candidates pick
    Revoke sessions and assume all access ends at once.
    Why it looks right
    The button says revoke.
    Why it's wrong
    Existing access tokens last until expiry unless the app supports continuous access evaluation.

    Clue to watch for The question asks when access actually stops.

  4. Legacy risk policies

    What candidates pick
    Configure the user risk policy in ID Protection settings.
    Why it looks right
    It is in the ID Protection blade.
    Why it's wrong
    Microsoft recommends risk-based Conditional Access policies, which allow exclusions, report-only testing and combined conditions.

    Clue to watch for The answer list offers both and mentions flexibility or testing.

  5. Per-user MFA

    What candidates pick
    Enable per-user MFA on each account.
    Why it looks right
    It is a direct switch.
    Why it's wrong
    Per-user MFA is legacy and ignores conditions; Conditional Access or security defaults should enforce MFA.

    Clue to watch for The scenario wants conditions or exclusions.

  6. VPN replacement with app proxy only

    What candidates pick
    Publish every internal app through application proxy to replace the VPN.
    Why it looks right
    Application proxy is familiar.
    Why it's wrong
    Non-web protocols such as RDP or SMB need Microsoft Entra Private Access with the Global Secure Access client.

    Clue to watch for The apps use TCP or UDP protocols beyond HTTP.

Answer framework

Work through these steps for authentication and access scenarios in Domain 2.

  1. Identify who is affected, which resources or actions are involved, and whether the trigger is a sign-in, a risk detection, a sensitive action or network traffic.
  2. Choose the authentication requirement: plain MFA, a phishing-resistant strength, a Temporary Access Pass for onboarding, or passwordless methods enabled in the Authentication methods policy.
  3. Build the Conditional Access policy with precise assignments and grant or session controls, excluding break-glass accounts and testing with What If and report-only mode.
  4. For risk, match sign-in risk to MFA and user risk to secure password change, and confirm users registered MFA so self-remediation works.
  5. For network access, choose the Global Secure Access profile, deploy clients and connectors, and link compliant network checks back into Conditional Access.

Practice question

Users report they were not prompted for MFA when accessing a SharePoint site labeled as highly confidential, although a policy requires MFA for that content. The policy targets an authentication context. Which tool lets the administrator see which Conditional Access policies applied to a past failed or successful sign-in?

Want more like this? The SC-300 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain the largest share of your study time. In a trial tenant with Entra ID P2, create a break-glass account first, then build policies one at a time: block legacy authentication, require MFA for admins with an authentication strength, require compliant devices for a test group. Leave each in report-only mode, sign in as test users, and read the Conditional Access tab in the sign-in logs before switching enforcement on.

Next, open the Authentication methods policy and enable passkeys, Temporary Access Pass and Microsoft Authenticator for a pilot group. Register a passkey in Authenticator and issue a Temporary Access Pass so you see the full user experience. Configure SSPR and password protection while you are there.

For ID Protection, use the documented ways to simulate detections, such as signing in through an anonymizing browser, then remediate them. Finish with Global Secure Access: enable the Microsoft traffic profile, install the client on a test VM, and publish one internal app with Private Access. Practice questions that ask you to predict combined policy outcomes are the best final check.

FAQ

How much of SC-300 is Domain 2, Implement authentication and access management?

Microsoft's Skills at a glance lists 25–30%, the largest skill area, though the detailed heading on the same page reads 20–25%. Either way it has four functional groups and the most objectives.

Is Global Secure Access on SC-300?

Yes. A functional group covers the Global Secure Access client, Microsoft Entra Private Access, Microsoft Entra Internet Access and the Microsoft traffic profile.

Which licence does Conditional Access need?

Conditional Access requires Microsoft Entra ID P1. Risk-based conditions and ID Protection features require Microsoft Entra ID P2.

What happens when two Conditional Access policies apply?

Both are enforced. The user must satisfy every grant requirement from all applicable policies, and any block control overrides grants.

Should I still study security defaults?

Know what they are: a free baseline that enforces MFA registration and blocks legacy authentication. They must be turned off before you can use Conditional Access policies.

What is the difference between What If and report-only?

What If simulates a sign-in you describe against current policies. Report-only mode evaluates real sign-ins and logs the result without enforcing the policy.

Can users fix their own risk?

Yes, if risk-based policies allow it and users have registered MFA. They clear sign-in risk with MFA and user risk with a secure password change.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered authentication methods, SSPR, Conditional Access, ID Protection and Global Secure Access. Test whether you can predict policy outcomes and pick the right control quickly.

Take the SC-300 practice test Check your SC-300 readiness

Keep going