SC-300 is the exam behind the Microsoft Certified: Identity and Access Administrator Associate title. It is the credential that says you can run Microsoft Entra ID for an organization: identities, authentication, access policy, application identities and governance. It is also the exam that most often surprises experienced administrators, because it tests the breadth of the product rather than the handful of blades they use every week.
This guide is about how to prepare. It does not try to teach Entra ID; it tells you what to learn, in what order, and how the questions are asked.
Who It Is For, and What to Have First
Microsoft calls it an associate exam and recommends familiarity with Entra ID and some Azure. In practice, people who pass comfortably have done two things: administered a tenant (even a small one) and built the features they had not used in a test tenant. If you have neither, budget twice the time.
Useful before you start:
- SC-900 if the vocabulary (tenant, Conditional Access, PIM, B2B) is new. It is not required.
- A tenant you can break. A trial of Microsoft Entra ID P2 and the Entra ID Governance add-on covers every feature on the outline.
- Working knowledge of OAuth 2.0, OpenID Connect and SAML at the level of "what is in an ID token" and "what is an SP-initiated flow". The exam does not test protocol internals, but several application questions are unanswerable without that foundation.
The Four Domains
Microsoft publishes a skills outline for every exam and revises it a few times a year. The domain names and approximate weights below are from the outline current when this guide was written; confirm them on the exam page before you book.
Implement and manage user identities (about 20–25%)
Tenant configuration, custom domains, user and group management, dynamic groups, administrative units, hybrid identity with Entra Connect or Cloud Sync, and external identities: B2B collaboration, cross-tenant access settings, B2B direct connect, and the self-service sign-up flows for guests.
Where people lose points: the differences between Entra Connect and Cloud Sync (Cloud Sync is agent-based, supports disconnected forests, lacks some features such as device writeback); which attributes dynamic membership rules can use; what an administrative unit can and cannot scope; and cross-tenant access settings, which are asked as "tenant A wants users of tenant B to use B's MFA" scenarios.
Implement authentication and access management (about 25–30%)
The largest domain and the one to over-prepare. Authentication methods and their policy (Authenticator, FIDO2 security keys, Windows Hello for Business, Temporary Access Pass, certificate-based authentication), authentication strengths, self-service password reset, password protection, Conditional Access in all its forms, Identity Protection risk policies, and the sign-in and audit logs.
Conditional Access is where scenario questions concentrate. You need to be able to read a policy in your head: assignments (users, target resources, conditions such as device platform, location, client app, risk, authentication context) and access controls (grant with MFA, compliant device, authentication strength, or block; session controls such as sign-in frequency and app-enforced restrictions). Expect at least one question about report-only mode, one about excluding break-glass accounts, and one about the "What If" tool.
Identity Protection questions turn on the difference between user risk (the account is probably compromised; remediate with a password change) and sign-in risk (this sign-in looks odd; remediate with MFA), and on the fact that risk-based policies are configured in Conditional Access rather than in the legacy Identity Protection policies.
Plan and implement workload identities (about 15–20%)
Application registrations versus enterprise applications (service principals), permissions and consent (delegated versus application permissions, admin consent, consent policies), app roles and groups claims, managed identities (system-assigned versus user-assigned), workload identity federation, Application Proxy, Conditional Access for workload identities, and Microsoft Defender for Cloud Apps policies as they relate to app access.
The reliable trap is consent. Know who can consent to what by default, what the admin consent workflow does, and that application permissions always need admin consent. The second trap is managed identity versus service principal with a secret: the exam wants managed identities whenever the workload runs in Azure.
Plan and implement identity governance (about 20–25%)
Entitlement management, access reviews, Privileged Identity Management and lifecycle workflows, plus the licensing that gates them. This domain has the most hands-on scenario questions and is covered in depth in the Entra ID Governance guide; build its six-week lab plan and you have this domain covered.
The Format, and How to Play It
The exam runs about 100 minutes with somewhere between 40 and 60 questions, and the pass mark is 700 on a scale to 1000. Scoring is scaled, so 700 does not mean 70% correct. Formats you will meet:
- Multiple choice and multiple select. Standard. Multiple select tells you how many to pick.
- Drag and drop and ordering. Usually "put these configuration steps in order". These reward lab experience; the order on the blade is the order in the answer.
- Case studies. A fictional company with requirements, an existing environment and planned changes, followed by several questions. Read the requirements section first and the questions second; most of the environment description is noise.
- Yes/No series. A scenario, a proposed solution, and "does this meet the goal?" repeated with different solutions. You cannot go back to earlier questions in the series. Answer each on its own merits; more than one solution can be "yes".
- Hot areas where you click a region of a screenshot of the portal.
Two tactics help more than any trick. First, the question usually names the goal in its last sentence; read that sentence before the scenario. Second, when two answers both work, the exam wants the one with least privilege, least administrative effort, or no additional cost, in that order of preference, and the question usually says which.
A Four-Week Plan
| Week | Learn | Build |
|---|---|---|
| 1 | User identities domain on Microsoft Learn | Custom domain, dynamic groups, an administrative unit with a scoped admin, two guests via B2B with cross-tenant access settings |
| 2 | Authentication and access management | Authentication methods policy with FIDO2 and TAP, SSPR, five Conditional Access policies in report-only then on, Identity Protection risk policies, a Log Analytics workspace receiving sign-in logs |
| 3 | Workload identities | An app registration with app roles and a groups claim, admin consent workflow, a managed identity reading a Key Vault secret, Application Proxy to an internal site |
| 4 | Governance, then review | The governance labs from the companion guide; the free Microsoft Learn practice assessment twice; reread every outline item you cannot explain in two sentences |
If you only have two weeks, keep weeks 2 and 4 and read the other two.
Common Mistakes
Studying the portal of 2022. Azure AD became Microsoft Entra ID in 2023 and the portal moved to entra.microsoft.com. Older courses and dumps use old names and old blades; the exam uses the new ones. Microsoft Learn is current; most third-party material is not.
Skipping licensing. Several questions are really "which license enables this". Know what P1 adds over Free (Conditional Access, dynamic groups, SSPR with writeback, Application Proxy), what P2 adds (Identity Protection, PIM, access reviews, entitlement management), and what the Governance add-on adds (lifecycle workflows, ML recommendations, custom extensions).
Confusing the two consents and the two permissions. Delegated permissions act as the signed-in user; application permissions act as the app. Users may consent to some delegated permissions depending on policy; application permissions always need an admin.
Treating Conditional Access as a firewall. Policies evaluate at sign-in and at token refresh, not continuously, unless continuous access evaluation applies. Questions about "immediately revoke" usually point at CAE or at revoking refresh tokens, not at a policy.
Not using practice assessments. Microsoft's free practice assessment uses the real question styles and references the Learn page for every item. Do it early to find weak domains, and again at the end.
Quick Reference
| Scenario keyword | Think of |
|---|---|
| "Only from compliant devices" | Conditional Access grant control: require device to be marked compliant (needs Intune) |
| "Phishing-resistant" | Authentication strength with FIDO2, Windows Hello for Business, or certificate-based authentication |
| "Users of partner tenant should satisfy MFA in their own tenant" | Cross-tenant access settings: trust MFA from the partner |
| "App running in Azure needs to call Graph without secrets" | Managed identity with application permissions, admin consented |
| "Workload outside Azure (GitHub Actions, another cloud) needs a token" | Workload identity federation |
| "Account appears compromised" | User risk policy: require password change |
| "Admin roles only when needed, with approval" | PIM eligible assignment with approval on activation |
| "Partners request access that expires" | Entitlement management, connected organization |
| "Disable on HR termination date" | Lifecycle workflow, leaver template |
| "Sign-ins from an unexpected country should be blocked" | Conditional Access with a named location condition; check report-only first |
Key Takeaways
- Four domains; authentication and access management is the biggest, governance is the most hands-on.
- Build every feature on the outline once in a test tenant. The exam asks for the order of steps and the name of the setting, and only practice gives you both.
- Learn the licensing boundaries between Free, P1, P2 and the Governance add-on.
- Read the last sentence of each question first, and prefer the answer with least privilege and least effort when more than one works.
- Use Microsoft Learn and its practice assessment; most older third-party material describes a portal that no longer exists.