SC-300 · Domain 4 of 4

SC-300 Domain 4: Plan and automate identity governance

Controlling who keeps access over time: entitlement management with catalogs and access packages, access reviews, Privileged Identity Management for roles, Azure resources and groups, emergency access accounts, and monitoring identity activity with logs, KQL, workbooks and Identity Secure Score.

Exam weight
20–25%
Official functional groups
4
Estimated questions estimate
~12
Suggested study time estimate
12–16 hrs

About 13 min read Reviewed October 2026

Overview

Domain 4 is about the full access lifecycle, from request through review to removal, plus the evidence that proves it. Microsoft lists four functional groups with 22 bullet objectives. Entitlement management covers planning, catalogs, access packages, access requests, terms of use, external user lifecycle and connected organizations. Access reviews cover planning, creating and configuring reviews, monitoring activity and responding manually.

Privileged access covers Privileged Identity Management for Microsoft Entra roles, for Azure resources and for groups, the request and approval process, PIM audit history and reports, and emergency access accounts. The monitoring group covers sign-in, audit and provisioning logs in the admin center, diagnostic settings that send logs to Log Analytics, storage or Event Hubs, KQL queries, workbooks and reports, and Identity Secure Score.

How it's tested

Governance questions describe a population, such as contractors, partner users or privileged admins, and a control goal like time-limited access, periodic recertification or approval before elevation. Monitoring questions describe an investigation or retention need. You choose the governance feature, its settings, or the log destination and tool.

  • Lifecycle by design

    Partner users need a bundle of groups, apps and sites with approval and automatic expiry, and you design catalogs, access packages and connected organizations.

  • Just-in-time elevation

    Admins must request a role with justification, MFA and approval, and you configure PIM role settings and eligible assignments.

  • Where is the evidence

    An auditor needs a year of sign-in data or a query of failed sign-ins, and you choose diagnostic settings, Log Analytics and KQL.

Reasoning it through

Contractors from a partner company need access to a Teams team, a SharePoint site and an app for ninety days, with manager approval and automatic removal. Inviting guests and adding them to groups manually leaves no expiry. An access package in a catalog holding all three resources, with a policy for the connected organization, approval, a ninety-day expiration and a quarterly review, meets every requirement and can remove guests when their last package ends.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

4.1 Plan and implement entitlement management in Microsoft EntraCatalogs, access packages, requests, terms of use, external lifecycle and connected organizations.
What it means
This group covers planning entitlements, creating catalogs that hold groups, apps and SharePoint sites, building access packages with assignment policies, managing access requests and approvals, implementing terms of use, managing the lifecycle of external users who receive access, and configuring connected organizations for partner directories or domains.
What to understand
A catalog is a container of resources plus delegated catalog owners. An access package bundles resource roles from one catalog, and policies define who can request, approval stages, expiration, separation of duties and access reviews. Connected organizations represent partner Entra tenants or domains whose users can request packages. External user lifecycle settings can block sign-in and then delete guests whose last package assignment ends. Terms of use are documents users must accept, enforced through a Conditional Access grant control, with options to require re-acceptance or expand on every device. Custom extensions can call Logic Apps during request workflows.
How it shows up
Expect a partner or contractor access scenario where you configure policy, approval, expiration and external user cleanup.
Common confusion
Thinking an access package can include resources from more than one catalog.
4.2 Plan, implement, and manage access reviews in Microsoft EntraReview planning, configuration, monitoring and manual response.
What it means
This group covers planning which access to recertify, creating access reviews for groups, apps, access packages and roles, choosing reviewers and recurrence, monitoring review progress, and responding manually to review activity such as approving or denying access and applying results.
What to understand
Reviews can target group members, guest users only, application assignments, access package assignments and, through PIM, privileged roles. Reviewers can be group owners, managers, selected users or the users themselves through self-review. Settings include duration, recurrence, recommendations based on sign-in activity, and what happens if reviewers do not respond: no change, remove access, approve access or take recommendations. Auto apply results removes denied users at the end. Multi-stage reviews add a second reviewer layer. Reviews of inactive users and of guests in all Microsoft 365 groups are common patterns. Admins can stop a review early or send reminders.
How it shows up
Expect a recertification requirement where you pick scope, reviewers, recurrence and the no-response action.
Common confusion
Assuming denied users are removed even when auto apply results is off.
4.3 Plan and implement privileged accessPIM for Entra roles, Azure resources and groups, approvals, audit history and emergency access.
What it means
This group covers planning and managing Microsoft Entra roles in PIM with role settings and assignments, doing the same for Azure resource roles, configuring PIM for Groups, managing the request and approval process, analyzing PIM audit history and reports, and creating and managing emergency access accounts.
What to understand
PIM makes assignments eligible instead of permanent, so users activate a role for a set number of hours with MFA or an authentication context, justification, ticket number and optional approval. Role settings are per role, and assignments can be time-bound. For Azure resources, PIM applies to RBAC roles at management group, subscription, resource group or resource scope. PIM for Groups manages eligible membership or ownership of a group, which can then hold roles or app access. Alerts flag issues such as too many Global Administrators. Emergency access accounts are cloud-only, excluded from Conditional Access and PIM dependencies where needed, protected with phishing-resistant credentials, and monitored for any sign-in.
How it shows up
Expect activation settings, approver setup, eligible versus active choices, and break-glass account design.
Common confusion
Mixing eligible assignments, which need activation, with active assignments, which grant access immediately.
4.4 Monitor identity activity by using logs, workbooks, and reportsSign-in, audit and provisioning logs, diagnostic settings, KQL, workbooks and Identity Secure Score.
What it means
This group covers reviewing sign-in, audit and provisioning logs in the Microsoft Entra admin center, configuring diagnostic settings to send logs to Log Analytics workspaces, storage accounts or Azure Event Hubs, querying Entra data with KQL, analyzing it with workbooks and reports, and improving security posture with Identity Secure Score.
What to understand
Sign-in logs record interactive, non-interactive, service principal and managed identity sign-ins. Audit logs record changes such as role assignments or policy edits, and provisioning logs record SCIM and cross-tenant sync activity. The admin center keeps data for a limited period based on license, so long-term retention needs diagnostic settings. Log Analytics enables KQL queries over tables like SigninLogs and AuditLogs plus workbooks; storage accounts suit cheap archive; Event Hubs stream to a third-party SIEM. Workbooks such as Conditional Access insights and reporting visualize policy impact. Identity Secure Score lists improvement actions with impact and status.
How it shows up
Expect a retention, SIEM or investigation requirement and a choice of destination, log type or KQL table.
Common confusion
Choosing a storage account when the requirement is to run KQL queries or workbooks.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Catalog

    Container of resources and delegated owners for entitlement management.

    Remember
    Access packages draw only from their own catalog.
    Tested as
    Delegation of access management.
    Trap
    Mixing resources across catalogs.

  • Access package

    Bundle of resource roles with request and lifecycle policies.

    Remember
    Can include groups, apps and SharePoint sites.
    Tested as
    Self-service access questions.
    Trap
    Expecting it to grant Microsoft Entra roles directly.

  • Connected organization

    Partner tenant or domain whose users may request packages.

    Remember
    Lets external users request without prior invitation.
    Tested as
    B2B governance questions.
    Trap
    Inviting every partner user manually.

  • Separation of duties

    Policy check that blocks requests conflicting with existing packages or groups.

    Remember
    Configured on the access package.
    Tested as
    Compliance scenarios.
    Trap
    Assuming PIM handles it.

  • Terms of use

    Document users must accept before access, enforced by Conditional Access.

    Remember
    Can require re-acceptance on a schedule.
    Tested as
    Guest onboarding questions.
    Trap
    Expecting it to work without a Conditional Access policy.

  • Access review no-response setting

    Defines the outcome when reviewers do not respond.

    Remember
    Options include remove access or take recommendations.
    Tested as
    Recertification design.
    Trap
    Leaving it at no change for strict compliance.

  • Eligible assignment

    Role a user can activate when needed.

    Remember
    Activation can require MFA, justification and approval.
    Tested as
    PIM design questions.
    Trap
    Granting permanent active roles.

  • PIM for Groups

    Just-in-time membership or ownership of a group.

    Remember
    Works with role-assignable and other security groups.
    Tested as
    Group-based privileged access.
    Trap
    Thinking PIM only covers directory roles.

  • Emergency access account

    Cloud-only break-glass account for lockout recovery.

    Remember
    Excluded from Conditional Access and alerted on every sign-in.
    Tested as
    Resilience questions.
    Trap
    Syncing it from on-premises AD.

  • Diagnostic settings

    Routes Entra logs to Log Analytics, storage or Event Hubs.

    Remember
    Required for long-term retention and KQL.
    Tested as
    Log retention questions.
    Trap
    Relying on default admin center retention.

  • SigninLogs table

    Log Analytics table for interactive user sign-ins.

    Remember
    Other sign-in types have separate tables.
    Tested as
    KQL questions.
    Trap
    Searching AuditLogs for sign-in failures.

  • Identity Secure Score

    Score with recommended actions to improve identity posture.

    Remember
    Actions show impact and status.
    Tested as
    Posture improvement questions.
    Trap
    Treating it as a compliance certification.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Assignment types in PIM

ConceptMeaningKey differenceCommon trap
Eligible Must be activated before use Just-in-time with optional approval Expecting immediate access
Active Access granted immediately Can still be time-bound Using permanent active for routine admins
Time-bound Assignment with start and end dates Expires automatically Confusing it with activation duration

Log destinations

ConceptMeaningKey differenceCommon trap
Log Analytics workspace Queryable store with KQL and workbooks Analysis and alerting Choosing it only for cheap archive
Storage account Low-cost long-term archive No KQL querying Expecting workbooks to read it
Event Hubs Stream to external systems Feeds a third-party SIEM Using it for in-portal reporting

Governance tools

ConceptMeaningKey differenceCommon trap
Entitlement management Request-based access with policies Grants and expires access Using it only for reviews
Access reviews Periodic recertification Removes access that is no longer needed Expecting it to grant new access
PIM Just-in-time privileged access Controls elevation of roles and groups Using it for non-privileged app access

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Manual guest cleanup

    What candidates pick
    Run a script each quarter to delete inactive guests.
    Why it looks right
    It removes stale accounts.
    Why it's wrong
    Access packages with expiration and external user lifecycle settings remove guests automatically and record evidence.

    Clue to watch for The scenario asks for automatic removal with least administrative effort.

  2. Active instead of eligible

    What candidates pick
    Assign Global Administrator as active for a year.
    Why it looks right
    It is time-bound.
    Why it's wrong
    Active assignments grant standing privilege; eligible assignments force activation with MFA, justification and approval.

    Clue to watch for Just-in-time or approval is mentioned.

  3. Storage for queries

    What candidates pick
    Send logs to a storage account to run KQL.
    Why it looks right
    Storage is cheapest.
    Why it's wrong
    KQL and workbooks need a Log Analytics workspace; storage is for archive only.

    Clue to watch for The requirement says query, analyze or alert.

  4. Review without auto apply

    What candidates pick
    Create an access review and expect denied users to disappear.
    Why it looks right
    Deny sounds final.
    Why it's wrong
    Results are applied only when auto apply is enabled or an admin applies them manually.

    Clue to watch for The question asks why denied users still have access.

  5. Break-glass with Conditional Access

    What candidates pick
    Include emergency accounts in the MFA policy for all users.
    Why it looks right
    Every account should have MFA.
    Why it's wrong
    Emergency accounts must be excluded so a broken policy or MFA outage cannot lock them out, with alerting on use.

    Clue to watch for The scenario describes lockout recovery.

  6. PIM for app access

    What candidates pick
    Use PIM to grant everyday app access to sales staff.
    Why it looks right
    PIM grants time-limited access.
    Why it's wrong
    Routine access belongs in entitlement management; PIM is for privileged roles and groups.

    Clue to watch for The users are not administrators.

Answer framework

Follow these steps for governance and monitoring scenarios in Domain 4.

  1. Classify the access: routine resource access, partner or guest access, privileged role or group, or an investigation and retention need.
  2. For routine or partner access, build a catalog and access package with request policy, approval, expiration and connected organizations, adding terms of use if acceptance is required.
  3. Schedule access reviews with suitable reviewers, recurrence, a no-response action that matches the risk, and auto apply results enabled.
  4. For privileged access, make assignments eligible in PIM, set activation requirements and approvers, cover Azure resources and groups, and keep two monitored emergency accounts.
  5. For monitoring, send logs through diagnostic settings to the right destination and use KQL, workbooks and Identity Secure Score to find and fix gaps.

Practice question

An organization must keep Microsoft Entra sign-in and audit logs for two years, run KQL queries against them, and alert when an emergency access account signs in. What should the administrator configure?

Want more like this? The SC-300 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Activate a Microsoft Entra ID P2 or ID Governance trial in your lab tenant, because nearly every feature here is licensed. Build one end-to-end flow: a catalog with a group, an app and a SharePoint site, an access package with approval and a thirty-day expiry, a connected organization for your second test tenant, then request the package as a partner user and approve it. Add a short access review to the package and practice applying the results.

For PIM, convert a test admin to an eligible assignment for a directory role, require MFA and approval, and activate it to see the full experience. Repeat for an Azure subscription role and a group with PIM for Groups. Create two emergency access accounts and note how you would exclude and monitor them.

Finally, create a Log Analytics workspace, add a diagnostic setting for sign-in and audit logs, and run simple KQL queries that filter failed sign-ins or role changes. Open the Conditional Access insights workbook and Identity Secure Score. Close with mixed practice questions, since governance answers often hinge on one setting.

FAQ

How much of SC-300 is Domain 4, Plan and automate identity governance?

Microsoft weights Plan and automate identity governance at 20–25%. It has four functional groups: entitlement management, access reviews, privileged access, and monitoring with logs, workbooks and reports.

Which licences do governance features need?

PIM, access reviews and entitlement management need Microsoft Entra ID P2 or Microsoft Entra ID Governance. Some advanced features such as lifecycle workflows need ID Governance.

What is the difference between an access package and PIM?

An access package grants routine access to groups, apps and sites with policies and expiry. PIM provides just-in-time activation of privileged roles and group membership.

How many emergency access accounts should I create?

Microsoft recommends at least two cloud-only emergency access accounts with phishing-resistant credentials, excluded from Conditional Access where needed and monitored for any sign-in.

How long are sign-in logs kept?

The admin center retains them for a limited period that depends on licence. For longer retention, configure diagnostic settings to a workspace, storage account or event hub.

Do I need to write complex KQL?

No. Be able to read and adapt simple queries that filter SigninLogs or AuditLogs by user, result, time and application, and know which table holds which data.

What changed in this domain in October 2026?

The study guide change log marks minor changes to the privileged access functional group. The bullet wording on this page follows the October 28, 2026 list.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered entitlement management, access reviews, PIM, emergency access and identity monitoring. Find out whether you can choose the right governance setting under exam pressure.

Take the SC-300 practice test Check your SC-300 readiness

Keep going