SC-900 · Domain 2 of 4

SC-900 Domain 2: Describe the capabilities of Microsoft Entra

The identity domain of SC-900: what Microsoft Entra ID is and the identity types it holds, hybrid identity, authentication methods and MFA, password protection, Conditional Access, Entra roles and RBAC, and the governance and protection features built on top.

Exam weight
25–30%
Official functional groups
4
Estimated questions estimate
~14
Suggested study time estimate
6–9 hrs

About 13 min read Reviewed October 2026

Overview

Domain 2 moves from identity theory to Microsoft Entra, and Microsoft groups it into four functional groups. The first covers what Microsoft Entra ID is, the types of identities it manages, including workload identities, and hybrid identity. The second covers authentication methods, multifactor authentication, and password protection and management, including self-service password reset. The third covers Conditional Access and Microsoft Entra roles with role-based access control.

The fourth group covers Microsoft Entra ID Governance, access reviews, Privileged Identity Management (PIM) and Microsoft Entra ID Protection. The October 2026 update made a minor change to the identity types group, so expect workload identities such as service principals and managed identities to be named directly. At 25–30%, this is the second-largest domain on the exam.

How it's tested

Expect scenario statements that describe an identity requirement, such as requiring MFA only for risky sign-ins or granting admin rights for two hours, and ask which Entra capability provides it. Several items test whether a feature exists at all, so precise knowledge of what each service does and does not do matters more than configuration steps.

  • Choose the Entra feature

    A requirement is described, and you pick Conditional Access, PIM, access reviews, ID Protection, entitlement management or self-service password reset.

  • Identify the identity type

    An application, Azure resource or external partner is described, and you name the identity type, such as managed identity, service principal or guest.

  • Pick the authentication method

    A sign-in requirement is stated, and you choose between passwords, Windows Hello for Business, FIDO2 security keys, Microsoft Authenticator, SMS or certificate-based authentication.

Reasoning it through

An organization wants global administrators to hold their role only when needed, with approval and a time limit. Conditional Access controls sign-in conditions but does not grant roles. Access reviews recertify existing access periodically rather than activating it. Privileged Identity Management provides just-in-time, time-bound and approval-based role activation, so PIM is the feature that meets this requirement.

Functional groups 4

Official functional groups from the Microsoft outline, in outline order.

2.1 Describe function and identity types of Microsoft Entra IDMicrosoft Entra ID, user, device, group and workload identities, and hybrid identity.
What it means
This group explains Microsoft Entra ID as Microsoft's cloud identity and access management service, the kinds of identities it stores, and how on-premises Active Directory identities connect to the cloud.
What to understand
Microsoft Entra ID authenticates users and apps for Microsoft 365, Azure and thousands of SaaS applications, and offers single sign-on. Identity types include users (members and guests), devices, groups, and workload identities. Workload identities are for software: an application registration creates an application object and a service principal, and managed identities are service principals Azure manages automatically, either system-assigned to one resource or user-assigned and shareable. Devices can be registered, joined or hybrid joined. External identities include B2B collaboration for guests. Hybrid identity uses Microsoft Entra Connect Sync or Microsoft Entra Cloud Sync, with password hash synchronization, pass-through authentication or federation as sign-in options.
How it shows up
Questions name an app, a resource or a partner and ask for the identity type, or ask which component synchronizes on-premises accounts.
Common confusion
Managed identities and service principals are often treated as different things; a managed identity is a special service principal whose credentials Azure handles.
2.2 Describe authentication capabilities of Microsoft Entra IDAuthentication methods, multifactor authentication, and password protection and management.
What it means
This group covers the ways users prove their identity in Microsoft Entra ID, how MFA combines factors, and the tools that make passwords stronger or less necessary.
What to understand
Methods include passwords, phone-based SMS and voice, OATH tokens, Microsoft Authenticator, Windows Hello for Business, FIDO2 security keys, passkeys and certificate-based authentication. Passwordless methods remove the password while still providing strong authentication. MFA requires two or more of something you know, something you have and something you are. Security defaults switch on baseline protections, including MFA registration, for tenants without Conditional Access. Self-service password reset lets users reset or unlock accounts after verifying with registered methods. Password protection blocks weak passwords using a global banned list and an optional custom list, and can extend to on-premises Active Directory.
How it shows up
Expect statements about which factors count as MFA, what security defaults do, or which feature stops users choosing easily guessed passwords.
Common confusion
Two passwords do not make MFA; the factors must come from different categories.
2.3 Describe access management capabilities of Microsoft Entra IDMicrosoft Entra Conditional Access and Microsoft Entra roles with RBAC.
What it means
This group describes how Entra decides whether to allow a sign-in and under what conditions, and how administrative permissions are divided through roles.
What to understand
Conditional Access policies work as if-then statements: signals such as user or group, application, location, device state, client app and sign-in or user risk lead to a decision to block access or grant it with requirements such as MFA, a compliant device or a password change. Policies are evaluated after first-factor authentication. Microsoft Entra roles control permissions to manage directory resources, such as User Administrator or Global Administrator, and can be built-in or custom. Azure RBAC roles control access to Azure resources like virtual machines and are a separate system. Least privilege means assigning the narrowest role that does the job.
How it shows up
A scenario lists conditions and outcomes, and you decide whether Conditional Access can enforce it, or which role type applies.
Common confusion
Entra roles and Azure resource roles are frequently mixed up; one manages the directory, the other manages Azure subscriptions and resources.
2.4 Describe identity protection and governance capabilities of Microsoft EntraMicrosoft Entra ID Governance, access reviews, PIM and Microsoft Entra ID Protection.
What it means
This group covers making sure the right people keep the right access over time and detecting identity-based risk, combining governance processes with automated risk detection.
What to understand
Microsoft Entra ID Governance manages the identity lifecycle with joiner, mover and leaver processes, entitlement management with access packages, lifecycle workflows and access reviews. Access reviews let owners or users recertify group membership, app access and role assignments on a schedule. Privileged Identity Management provides just-in-time and time-bound role activation, approval, justification, notifications and audit history. Microsoft Entra ID Protection detects user risk, such as leaked credentials, and sign-in risk, such as anonymous IP addresses or atypical travel, and can feed those risk levels into Conditional Access policies, or export them to other tools.
How it shows up
Questions describe a governance goal or a risky behavior and ask which of the four capabilities addresses it.
Common confusion
PIM and access reviews both concern access; PIM controls when privileged roles are active, access reviews confirm whether access should continue.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Microsoft Entra ID

    Microsoft's cloud identity and access management service.

    Remember
    Formerly Azure Active Directory.
    Tested as
    Foundation for every identity question.
    Trap
    Treating it as cloud-hosted Active Directory Domain Services.

  • Workload identities

    Identities for apps and services, not people.

    Remember
    Include service principals and managed identities.
    Tested as
    Named directly after the October 2026 update.
    Trap
    Assuming apps sign in as users.

  • Managed identity

    Azure-managed service principal for a resource.

    Remember
    System-assigned is tied to one resource; user-assigned can be shared.
    Tested as
    Credential-free access scenarios.
    Trap
    Thinking developers must rotate its secrets.

  • Hybrid identity

    Single identity across on-premises AD and Entra ID.

    Remember
    Uses Entra Connect Sync or Cloud Sync.
    Tested as
    Synchronization scenarios.
    Trap
    Confusing password hash sync with federation.

  • Multifactor authentication

    Two or more factors from different categories.

    Remember
    Know, have, are.
    Tested as
    Factor-classification statements.
    Trap
    Counting two knowledge factors as MFA.

  • Self-service password reset

    Users reset their own passwords after verification.

    Remember
    Reduces helpdesk calls.
    Tested as
    Feature-matching questions.
    Trap
    Confusing it with password protection.

  • Password protection

    Blocks weak passwords using banned lists.

    Remember
    Global list plus optional custom list.
    Tested as
    Weak password scenarios.
    Trap
    Thinking it forces MFA.

  • Conditional Access

    If-then policy engine using sign-in signals.

    Remember
    Evaluated after first-factor authentication.
    Tested as
    Policy scenario questions.
    Trap
    Believing it detects risk on its own.

  • Microsoft Entra roles

    Permissions to manage directory objects.

    Remember
    Separate from Azure RBAC resource roles.
    Tested as
    Role-type questions.
    Trap
    Using Global Administrator when a narrower role fits.

  • Privileged Identity Management

    Just-in-time, time-bound privileged role activation.

    Remember
    Supports approval and justification.
    Tested as
    Standing admin access scenarios.
    Trap
    Confusing it with access reviews.

  • Access reviews

    Periodic recertification of access.

    Remember
    Cover groups, apps and role assignments.
    Tested as
    Stale access scenarios.
    Trap
    Expecting it to grant access on demand.

  • Microsoft Entra ID Protection

    Detects user risk and sign-in risk.

    Remember
    Feeds risk into Conditional Access.
    Tested as
    Risky sign-in scenarios.
    Trap
    Mixing up user risk and sign-in risk.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

PIM vs. access reviews vs. entitlement management

ConceptMeaningKey differenceCommon trap
Privileged Identity Management Activates privileged roles when needed Time-bound, approval-based Using it to recertify all group memberships
Access reviews Recertifies existing access Periodic attestation by reviewers Expecting it to grant access
Entitlement management Access packages users request Bundles resources with policies and expiry Confusing it with a single role assignment

Conditional Access vs. ID Protection

ConceptMeaningKey differenceCommon trap
Conditional Access Enforces access decisions from signals Policy engine, grant or block Assuming it calculates risk
ID Protection Calculates user and sign-in risk Detection and risk scoring Assuming it is a separate policy engine for all access

Hybrid sign-in options

ConceptMeaningKey differenceCommon trap
Password hash synchronization Hash of the password hash synced to the cloud Cloud authenticates the user Thinking plain passwords are synced
Pass-through authentication On-premises agent validates the password AD checks the password in real time Confusing it with federation
Federation External provider such as AD FS authenticates Most infrastructure to run Choosing it when simplicity is the goal

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Reviews grant access

    What candidates pick
    Pick access reviews for temporary admin activation.
    Why it looks right
    Both features manage privileged access.
    Why it's wrong
    Access reviews only recertify whether existing access should continue; PIM handles time-bound activation.

    Clue to watch for Words such as activate, approve or for two hours.

  2. CA detects risk

    What candidates pick
    Say Conditional Access identifies leaked credentials.
    Why it looks right
    Conditional Access policies can use risk conditions.
    Why it's wrong
    Risk detection comes from ID Protection; Conditional Access only acts on the risk level supplied.

    Clue to watch for Leaked credentials, atypical travel or anonymous IP.

  3. Two passwords equal MFA

    What candidates pick
    Accept a password and PIN as two factors.
    Why it looks right
    Two separate prompts appear.
    Why it's wrong
    Both are knowledge factors, so it is single-factor authentication with two steps.

    Clue to watch for Factors that are both things you know.

  4. Directory admin from Azure RBAC

    What candidates pick
    Assign the Owner role on a subscription to manage users.
    Why it looks right
    Owner sounds all-powerful.
    Why it's wrong
    Azure RBAC roles govern Azure resources; managing users requires a Microsoft Entra role such as User Administrator.

    Clue to watch for The task involves users, groups or app registrations.

  5. Managed identity needs secrets

    What candidates pick
    State that developers must store and rotate a managed identity password.
    Why it looks right
    Service principals often use client secrets.
    Why it's wrong
    Azure handles managed identity credentials automatically, which is the main reason to use one.

    Clue to watch for An Azure resource needs to reach another service without stored credentials.

  6. Cloud Sync equals federation

    What candidates pick
    Choose federation whenever on-premises accounts are synchronized.
    Why it looks right
    Both involve hybrid identity.
    Why it's wrong
    Synchronization tools copy identities; federation is one of several sign-in methods and is not required for hybrid identity.

    Clue to watch for The requirement is simply one identity for cloud and on-premises.

Answer framework

When a Domain 2 scenario names an identity need, walk through these steps to find the right Microsoft Entra capability.

  1. Decide whether the question concerns who the identity is, how it signs in, what it can access, or whether its access is still appropriate.
  2. For identity type questions, separate people (members, guests) from software (service principals, managed identities) and from devices.
  3. For sign-in strength, choose MFA, passwordless methods, security defaults, password protection or self-service password reset by the exact gap described.
  4. For access decisions based on conditions, choose Conditional Access, and add ID Protection only when risk detection is part of the requirement.
  5. For ongoing control, pick PIM for just-in-time roles, access reviews for recertification and entitlement management for requestable access packages.

Practice question

A company wants users who sign in from an anonymous IP address to be prompted for multifactor authentication automatically, while normal sign-ins proceed without extra prompts. Which combination of Microsoft Entra capabilities meets this requirement?

Want more like this? The SC-900 practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Budget six to nine hours. Start with Microsoft Entra ID itself and the identity types, paying attention to workload identities, since the October 2026 change log touched that group. Build a small table of user, guest, device, service principal and managed identity, with one example of each.

Next, study authentication: list every method, mark which are passwordless and which are phishing resistant, and practice classifying factor combinations as MFA or not. Then learn Conditional Access as signals, decision and enforcement, and write three sample policies in plain language.

Finish with governance and protection, which produce the most confused answers. Make a four-column comparison of PIM, access reviews, entitlement management and ID Protection, listing trigger, purpose and output for each. If you have access to a free Microsoft 365 developer tenant or a trial, open the Microsoft Entra admin center and look at each blade, as seeing the menus helps fix the names. Close with timed practice questions and review every miss against your comparison table.

FAQ

How much of SC-900 is Domain 2, Describe the capabilities of Microsoft Entra?

Domain 2 is 25–30% of the exam, the second-largest share, organized into four functional groups covering identity types, authentication, access management, and protection and governance.

What changed in this domain in October 2026?

The change log lists a minor change to the group on function and identity types of Microsoft Entra ID. The bullet on identity types now explicitly includes workload identities.

Is Azure Active Directory still tested?

The product is now called Microsoft Entra ID, and SC-900 uses the Entra names throughout. Knowing the old name helps when reading older material, but answers use current names.

Do I need to know licensing for Entra features?

Only at a high level. Some capabilities, such as PIM and ID Protection, require premium licensing, but SC-900 focuses on what each feature does rather than detailed license mapping.

What is the difference between user risk and sign-in risk?

User risk is the likelihood that an account is compromised, such as leaked credentials. Sign-in risk is the likelihood that a specific authentication request is not from the account owner.

Is Conditional Access the same as security defaults?

No. Security defaults are a fixed set of baseline protections for tenants that do not use Conditional Access. Conditional Access provides granular, custom policies.

Are guests and workload identities in the same category?

No. Guests are external people invited through B2B collaboration, while workload identities belong to applications and services.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have reviewed Entra ID, identity types, authentication methods, Conditional Access, roles and identity governance. Test whether you can pick the right feature under time pressure.

Take the SC-900 practice test Check your SC-900 readiness

Keep going