SC-300: Microsoft Identity and Access Administrator Practice Exam

What the SC-300 exam covers

• Implement and manage user identities232 questions
• Implement authentication and access management225 questions
• Plan and implement workload identities223 questions
• Plan and automate identity governance223 questions

Free SC-300 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 903.

1. Question 1Implement and manage user identities

   Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. Several users have UPN suffixes that use a non-routable domain (contoso.local). You need to ensure these users can sign in to Microsoft 365 services after synchronization. What should you do?

   • AConfigure Microsoft Entra Connect to use the sAMAccountName attribute as the cloud sign-in identifier for these users
   • BAdd a custom domain name to Microsoft Entra ID that matches the contoso.local namespace and verify it through DNS
   • CChange the mail attribute for each affected user to a routable domain and use that value as the primary sign-in identifier
   • DAdd a routable UPN suffix in Active Directory Domains and Trusts, update affected accounts, then synchronizeCorrect
   ✓ Correct answer: D

   Microsoft Entra ID requires that the UPN suffix be a verified, internet-routable domain, so a non-routable suffix such as contoso.local cannot be used for cloud sign-in. The fix is to add an alternate UPN suffix that matches a public domain you own in Active Directory Domains and Trusts, switch the affected users to that suffix, and then let Entra Connect synchronize the corrected userPrincipalName. After sync the cloud UPN is routable and works for Microsoft 365 authentication. This keeps the on-premises and cloud identities aligned without changing the sign-in model.

   Why the other options are wrong

   • AConfiguring Entra Connect to use sAMAccountName is wrong because the cloud sign-in identifier must be a UPN-formatted, routable name, and sAMAccountName is a flat NetBIOS-style value that Entra ID does not accept for authentication.
   • BAdding contoso.local as a custom domain is wrong because Entra ID can only verify domains you can prove ownership of through public DNS, and a non-routable .local namespace has no public DNS to add the verification record to.
   • CChanging the mail attribute is wrong because the mail attribute is not the sign-in identifier; Entra ID authenticates against userPrincipalName, so editing mail does not make the account usable for sign-in.
2. Question 2Implement and manage user identities

   Your organization wants to allow users to sign in using their GitHub accounts. Which Microsoft Entra ID feature should you configure?

   • AExternal identities with a GitHub identity providerCorrect
   • BApplication proxy with GitHub connector
   • CConditional Access with GitHub integration
   • DEntra Connect with GitHub synchronization
   ✓ Correct answer: A

   Microsoft Entra External ID (external identities) lets you add social and external identity providers so guests or customers can sign in with an account they already have. Adding GitHub as an identity provider registers an OAuth trust between Entra ID and GitHub, after which users authenticate with their GitHub credentials instead of receiving a new company account. This is the purpose-built way to enable GitHub sign-in; the other options handle app publishing, access policy, or directory synchronization rather than federating an external identity provider.

   Why the other options are wrong

   • BApplication Proxy publishes on-premises web apps for remote access; it does not federate a GitHub identity for sign-in.
   • CConditional Access enforces access controls such as MFA on a sign-in; it does not provide authentication through GitHub.
   • DEntra Connect synchronizes on-premises Active Directory identities to Entra ID; it has no GitHub integration.
3. Question 3Implement authentication and access management

   Security defaults in Microsoft Entra ID and Conditional Access policies can be enabled simultaneously for the same tenant.

   • ATrue
   • BFalseCorrect
   ✓ Correct answer: B

   Security defaults and Conditional Access policies cannot both be enabled simultaneously for the same tenant. Security defaults provide baseline security protections (requiring MFA for admins, protecting privileged roles, etc.), while Conditional Access allows granular policy control. Microsoft Entra ID requires choosing one approach: either enable security defaults for baseline protection, or disable them to use custom Conditional Access policies. Enabling both would create conflicting policies and unpredictable behavior. The statement is false because they are mutually exclusive features that cannot coexist.

   Why the other options are wrong

   • ATrue is incorrect. The statement is false: Security defaults and Conditional Access policies cannot both be enabled simultaneously for the same tenant.
4. Question 4Plan and implement workload identities

   You are configuring an application's token configuration in Microsoft Entra ID. You need to include the user's group memberships in the ID token. The user belongs to more than 200 groups. What happens when the groups claim is configured?

   • AThe token includes only the first 200 group IDs and silently drops the rest
   • BToken generation fails with an error indicating too many group memberships
   • CThe token includes an overage claim with a Microsoft Graph URLCorrect
   • DAll group IDs are embedded in the token regardless of the total group count
   ✓ Correct answer: C

   Entra ID limits how many group IDs it will embed directly in a token (about 150 for SAML and 200 for JWT). When a user exceeds that limit, Entra ID does not fail token issuance and does not silently truncate the list. Instead it emits a 'groups overage' claim: the token contains _claim_names and _claim_sources entries pointing to a Microsoft Graph endpoint (the user's getMemberObjects/memberOf URL). The application must then call Microsoft Graph with the user's token to retrieve the complete set of group memberships.

   Why the other options are wrong

   • AEntra ID does not silently include only the first 200 groups and drop the rest; it switches to the overage claim mechanism instead.
   • BToken generation does not fail with a too-many-groups error; the overage claim exists specifically so issuance succeeds.
   • DAll group IDs are not included regardless of count; exceeding the limit triggers the overage claim rather than embedding every group.
5. Question 5Plan and automate identity governance

   You need to configure PIM so that the Contributor role assignment for an Azure subscription automatically expires after 6 months, even if the user does not deactivate it. Which PIM setting controls this behavior?

   • AMaximum activation duration
   • BActivation expiration setting
   • CMaximum eligible assignment duration
   • DMaximum active assignment durationCorrect
   ✓ Correct answer: D

   The requirement is that the Contributor assignment itself lapses after 6 months regardless of activation, and six months is far longer than any single just-in-time activation, which is measured in hours. That is governed by the maximum active assignment duration - the "Expire active assignments after" setting on the Azure resource role in PIM - which caps how long an active (assigned) role remains before PIM removes it and returns the user to eligible-only or unassigned. Setting it to six months makes the active assignment expire automatically with no manual deactivation.

   Why the other options are wrong

   • AMaximum activation duration only limits how long a single activation stays active (hours per activation); it cannot express a six-month assignment lifetime.
   • BThere is no separate "activation expiration" control; how long an activation lasts is set by the activation maximum duration, not a distinct toggle.
   • CMaximum eligible assignment duration limits how long the underlying eligibility lasts before it must be renewed - the eligibility lifecycle, not the active assignment duration.
6. Question 6Implement and manage user identities

   An administrator at Fabrikam Inc. needs to create 400 new user accounts in Microsoft Entra ID from a spreadsheet in a single operation. Which method should the administrator use to perform this bulk create in the Microsoft Entra admin center?

   • AImport users from a CSV template using Bulk createCorrect
   • BConfigure a dynamic membership rule on a security group
   • CRun Microsoft Entra Connect Sync from on-premises AD
   • DAdd users individually with the New user wizard
   ✓ Correct answer: A

   In the Microsoft Entra admin center, Users has a Bulk operations menu with Bulk create. The administrator downloads the provided CSV template, fills in required fields such as user principal name and display name, uploads it, and Entra provisions all accounts in one job that can be monitored under Bulk operation results. This is the correct tool for creating 400 cloud-only accounts from a spreadsheet.

   Why the other options are wrong

   • BA dynamic membership rule automatically places existing users into a group based on attributes; it manages group membership and does not create user accounts.
   • CMicrosoft Entra Connect Sync provisions accounts from on-premises Active Directory, but the source here is a spreadsheet of new cloud users, not an on-premises directory.
   • DThe New user wizard creates one account at a time and is impractical and error prone for 400 accounts, defeating the purpose of a bulk operation.
7. Question 7Plan and implement workload identities

   Application proxy is a supported feature when implementing solutions for organizations like Adatum Corporation.

   • TrueTrueCorrect
   • FalseFalse
   ✓ Correct answer: True

   Application proxy is a supported feature when implementing solutions for organizations like Adatum Corporation. Application proxy enables secure external access to internal applications through a connector.

   Why the other options are wrong

   • FalseFalse is incorrect. The statement is true: Application proxy is a supported feature when implementing solutions for organizations like Adatum Corporation. Application proxy enables secure external access to internal applications through a connector.
8. Question 8Implement and manage user identities

   You are configuring a dynamic membership group in Microsoft Entra ID that must contain every member (non-guest) user whose department is either Sales or Marketing and whose country is Canada. Which dynamic membership rule syntax is correct?

   • A(user.department -in ["Sales","Marketing"]) and (user.country -eq "Canada") and (user.userType -eq "Member")Correct
   • B(user.department -eq "Sales","Marketing") and (user.country = "Canada") and (user.userType = "Member", "Guest")
   • C(user.department -contains "Sales" or "Marketing") and (user.country -is "Canada") and (member -eq true)
   • D(user.department -match [Sales,Marketing]) && (user.country -eq Canada) && (user.userType -eq Member())
   ✓ Correct answer: A

   Dynamic membership rules use property names like user.department, supported operators such as -eq and -in, and logical keywords and/or. The -in operator tests membership against a bracketed, comma-separated, double-quoted list, so checking department against ["Sales", "Marketing"] is valid. Adding user.country -eq "Canada" and user.userType -eq "Member" correctly scopes the group to Canadian member users.

   Why the other options are wrong

   • B-eq compares a single value, so passing two comma-separated values to it is invalid, and the assignment operator = is not used in rule syntax (equality is -eq).
   • C-contains is for string containment on a single property and the bare or "Marketing" clause is not valid; -is is a type-of operator, not an equality test for a value.
   • DRule syntax uses the keyword and rather than the && symbol, -match expects a regular expression string, and string literals such as Canada must be double-quoted.
9. Question 9Implement authentication and access management

   Your hybrid users are federated with AD FS. You want to deprecate AD FS and move smart card sign-in to cloud authentication while keeping the same physical smart cards. Which Microsoft Entra feature lets you continue smart card sign-in without AD FS?

   • AMicrosoft Entra certificate-based authenticationCorrect
   • BPass-through authentication with the connector agent
   • CSeamless single sign-on on domain-joined devices
   • DPassword hash synchronization with Connect Sync
   ✓ Correct answer: A

   Microsoft Entra certificate-based authentication (CBA) allows users to authenticate with X.509 certificates, including those on smart cards, directly against Microsoft Entra ID. This is the supported path to retire AD FS while preserving smart card sign-in, because validation moves to the cloud. You configure trusted CAs, username binding, and the CBA method in the Authentication methods policy.

   Why the other options are wrong

   • BPass-through authentication validates passwords against on-premises AD; it does not provide smart card certificate sign-in.
   • CSeamless single sign-on enables silent sign-in on corporate devices but does not handle smart card certificate authentication.
   • DPassword hash synchronization is a password-based method and does not support smart cards.
10. Question 10Plan and implement workload identities

    Through Microsoft Defender for Cloud Apps, an analyst identifies an OAuth application that was consented to by many users and holds high-privilege Microsoft Graph permissions but is now flagged as malicious. What is the most direct action available in Defender for Cloud Apps to stop the app from accessing data?

    • ABan (disable) the OAuth app, which revokes its consent and its access tokens tenant-wideCorrect
    • BReset the account passwords of every user who previously consented to the flagged OAuth application
    • CCreate an app governance policy that alerts on the app's future activity but leaves its current access in place
    • DDisable the entire Microsoft Graph API across the whole tenant so the app can no longer call it
    ✓ Correct answer: A

    Defender for Cloud Apps lets you ban or disable a flagged OAuth application directly from the OAuth apps page. This revokes the application's permissions and invalidates its access, immediately stopping it from reading or acting on user and tenant data. It is the most targeted remediation for a malicious consented app.

    Why the other options are wrong

    • BResetting user passwords does not revoke the OAuth app's delegated or app permissions.
    • CAn alert-only governance policy notifies you of activity but does not revoke the app's existing access, so it keeps reaching data.
    • DDisabling Microsoft Graph for the tenant would break legitimate apps and is not a targeted action.

Related Microsoft resources

• SC-300 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

SC-300 practice exam FAQ