SC-300: Microsoft Identity and Access Administrator Practice Exam

What the SC-300 exam covers

• Implement and manage user identities239 questions
• Implement authentication and access management231 questions
• Plan and implement workload identities229 questions
• Plan and automate identity governance229 questions

Free SC-300 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 928.

1. Question 1Implement and manage user identities

   Your organization is migrating from on-premises Active Directory to Microsoft Entra ID. Several users have UPN suffixes that use a non-routable domain (contoso.local). You need to ensure these users can sign in to Microsoft 365 services after synchronization. What should you do?

   • AConfigure Microsoft Entra Connect to use the sAMAccountName attribute as the cloud sign-in identifier for these users
   • BAdd a custom domain name to Microsoft Entra ID that matches the contoso.local namespace and verify it through DNS
   • CChange the mail attribute for each affected user to a routable domain and use that value as the primary sign-in identifier
   • DAdd a routable UPN suffix in Active Directory Domains and Trusts, update affected accounts, then synchronizeCorrect
   ✓ Correct answer: D

   Microsoft Entra ID requires that the UPN suffix be a verified, internet-routable domain, so a non-routable suffix such as contoso.local cannot be used for cloud sign-in. The fix is to add an alternate UPN suffix that matches a public domain you own in Active Directory Domains and Trusts, switch the affected users to that suffix, and then let Entra Connect synchronize the corrected userPrincipalName. After sync the cloud UPN is routable and works for Microsoft 365 authentication. This keeps the on-premises and cloud identities aligned without changing the sign-in model.

   Why the other options are wrong

   • AConfiguring Entra Connect to use sAMAccountName is wrong because the cloud sign-in identifier must be a UPN-formatted, routable name, and sAMAccountName is a flat NetBIOS-style value that Entra ID does not accept for authentication.
   • BAdding contoso.local as a custom domain is wrong because Entra ID can only verify domains you can prove ownership of through public DNS, and a non-routable .local namespace has no public DNS to add the verification record to.
   • CChanging the mail attribute is wrong because the mail attribute is not the sign-in identifier; Entra ID authenticates against userPrincipalName, so editing mail does not make the account usable for sign-in.
2. Question 2Implement and manage user identities

   You need to create a dynamic group that automatically includes all users from the Marketing department. Which attribute expression should you use in the dynamic membership rule?

   • Auser.role -contains "Marketing"
   • Buser.organizationalUnit -eq "Marketing"
   • Cuser.group -eq "Marketing"
   • Duser.department -eq "Marketing"Correct
   ✓ Correct answer: D

   Department is a single-valued string attribute, so the correct dynamic rule tests it with the exact-match operator: user.department -eq "Marketing" includes every user whose department equals Marketing. The user. prefix and proper attribute name are required for the rule to validate. This precisely captures the Marketing department without pulling in unrelated users.

   Why the other options are wrong

   • Auser.role -contains "Marketing" is wrong because role is not the department attribute and -contains is for multi-valued attributes, so the expression targets the wrong property.
   • Buser.organizationalUnit -eq "Marketing" is wrong because organizationalUnit is not a valid Entra ID dynamic-membership attribute; department is the correct property.
   • Cuser.group -eq "Marketing" is wrong because there is no such user.group attribute for dynamic rules; membership is based on the department attribute here.
3. Question 3Implement authentication and access managementSelect all that apply

   Which THREE grant controls are available in Microsoft Entra Conditional Access policies? (Choose three.)

   • ARequire specific browser version
   • BRequire multi-factor authenticationCorrect
   • CRequire approved client appCorrect
   • DRequire device to be marked as compliantCorrect
   • ERequire password change every 30 days
   ✓ Correct answer: B, C, D

   These three are core grant controls in Conditional Access policies. Require MFA ensures authentication using multiple factors. Require approved client app restricts access to only Microsoft-approved applications. Require device compliance ensures only compliant devices can access resources. These controls address different security aspects: authentication strength, application trust, and device posture.

   Why the other options are wrong

   • ARequire specific browser version is incorrect because Conditional Access cannot enforce specific browser versions; it can only distinguish between browser and mobile app categories.
   • ERequire password change every 30 days is incorrect because this is a password policy setting, not a Conditional Access grant control.
4. Question 4Plan and implement workload identities

   Microsoft Entra Application Proxy requires inbound ports to be opened on the corporate firewall.

   • ATrue
   • BFalseCorrect
   ✓ Correct answer: B

   Microsoft Entra Application Proxy does not require inbound ports to be opened on the corporate firewall. The connector establishes outbound HTTPS connectivity to the proxy service. Users connect to the proxy service from the internet, not directly to the on-premises application. The statement is false because only outbound connectivity is required.

   Why the other options are wrong

   • ATrue is incorrect. The statement is false: Microsoft Entra Application Proxy does not require inbound ports to be opened on the corporate firewall. The connector establishes outbound HTTPS connectivity to the proxy service.
5. Question 5Plan and automate identity governance

   In Microsoft Entra Privileged Identity Management, what is the difference between an 'eligible' assignment and an 'active' assignment?

   • AEligible assignments require MFA, while active assignments never require MFA
   • BEligible assignments target groups, while active assignments target users
   • CEligible assignments need activation first; active assignments are always onCorrect
   • DEligible assignments are always temporary, while active assignments are permanent
   ✓ Correct answer: C

   This statement accurately defines the core distinction between the two PIM assignment types. An eligible assignment makes a user eligible to use a role but the role is not immediately active; the user must activate it through PIM when needed. An active assignment (also called permanent assignment) grants the role immediately without requiring activation steps.

   Why the other options are wrong

   • AEligible assignments require MFA; active assignments do not is incorrect because both assignment types can have MFA requirements configured independently.
   • BEligible assignments are for groups; active assignments are for users is incorrect because both assignment types apply to users; the target type does not distinguish them.
   • DEligible assignments are temporary; active assignments are permanent is incorrect because both types can have expiration dates; the activation requirement, not duration, is the distinguishing factor.
6. Question 6Implement and manage user identities

   Deleted users recovery is a supported feature when implementing solutions for organizations like Tailwind Traders.

   • ATrueCorrect
   • BFalse
   ✓ Correct answer: A

   Deleted users recovery is indeed a supported feature in Microsoft Entra ID. Administrators can recover deleted user accounts within a 30-day retention period, protecting against accidental deletion and enabling account restoration when needed.

   Why the other options are wrong

   • BFalse is incorrect. The statement is true: Deleted users recovery is indeed a supported feature in Microsoft Entra ID. Administrators can recover deleted user accounts within a 30-day retention period, protecting against accidental deletion and enabling account restoration when needed.
7. Question 7Plan and automate identity governanceSelect all that apply

   Proseware Inc wants to organize the apps and groups that make up its self-service access bundles into departmental containers that delegated owners can manage, and it must ensure administrators elevate to sensitive directory roles only for a limited time with justification. Which TWO items should the administrator configure? (Choose two.)

   • APIM for Azure resources
   • BIdentity Secure Score
   • CPrivileged Identity Management for Entra rolesCorrect
   • DPIM alerts
   • EEntitlement management catalogsCorrect
   ✓ Correct answer: C, E

   Entitlement management catalogs are containers that hold the apps, groups, and sites used in access packages, and catalog owners can be delegated to manage their department's resources. Privileged Identity Management for Entra roles makes sensitive directory roles eligible so administrators activate them only for a limited time with justification.

   Why the other options are wrong

   • APIM for Azure resources governs Azure resource roles such as subscription Owner, not directory roles or the containers for access packages.
   • BIdentity Secure Score reports on security posture with recommendations; it does not organize access-package resources or provide role elevation.
   • DPIM alerts surface risky role configurations but neither organize entitlement resources nor perform just-in-time elevation.
8. Question 8Implement and manage user identities

   Your tenant has the default https://contoso.onmicrosoft.com domain plus two verified custom domains, contoso.com and contoso.co.uk. You delete the contoso.com domain to consolidate. The deletion fails. What must you do before a custom domain can be removed?

   • AClear every reference to contoso.com: user UPNs, group addresses, and appsCorrect
   • BSet contoso.com as the tenant's primary domain before you attempt to delete it
   • CDelete the contoso.onmicrosoft.com default domain ahead of the custom domain
   • DConvert the domain from managed to federated authentication before deletion
   ✓ Correct answer: A

   Microsoft Entra blocks deletion of a custom domain that is still in use. You must update or remove every reference - user principal names, group or mailbox addresses, application identifiers, and similar - so nothing depends on contoso.com. After all references are cleared, the domain deletes successfully.

   Why the other options are wrong

   • BYou cannot delete the primary domain; making it primary would prevent deletion, not enable it.
   • CThe default onmicrosoft.com domain cannot be deleted and is unrelated to removing a custom domain.
   • DAuthentication type (managed vs federated) does not gate domain deletion; outstanding references do.
9. Question 9Implement authentication and access managementSelect all that apply

   You must build a named location strategy. Branch offices use known public egress IPv4 ranges, and you also want to flag impossible-travel-style anomalies based on country. Which TWO named location capabilities should you use to support trusted-network logic and country-based conditions? (Choose two.)

   • ADefine an IP ranges named location with the branch public IPv4 CIDR blocks and mark it as trustedCorrect
   • BDefine a Countries named location and determine location by IP address or by Authenticator GPS coordinatesCorrect
   • CDefine a named location that enumerates individual managed device IDs to trust specific corporate laptops
   • DDefine a named location that references a Conditional Access authentication strength to require phishing-resistant MFA
   ✓ Correct answer: A, B

   A named location can be defined by IP ranges using CIDR blocks, and such a location can be flagged as trusted so policies can treat it as a known network. A named location can also be defined by countries or regions, with the location determined either by IP address or by GPS coordinates collected through the Microsoft Authenticator app, which supports country-based conditions and anomaly flagging.

   Why the other options are wrong

   • CNamed locations are based on IP ranges or countries, not lists of device IDs; device trust is handled by device controls, not locations.
   • DAuthentication strength is a grant control, not a named location attribute; you cannot embed it inside a named location.
10. Question 10Plan and automate identity governance

    You configure an access package that grants membership to a Microsoft 365 group and access to an enterprise application. A user's assignment to the access package is removed (the assignment expires). What happens to the resource access the package granted?

    • AEntitlement management deprovisions the group membership and app assignmentCorrect
    • BThe user keeps the group membership and app assignment until an admin removes them
    • COnly the enterprise application assignment is removed and the group membership stays
    • DThe user is blocked from signing in to the whole tenant until they are reassigned
    ✓ Correct answer: A

    Access packages bundle resource roles. When an assignment expires or is removed, entitlement management revokes exactly the access it provisioned, removing the user's group membership and the enterprise application assignment that came from the package. This automatic cleanup is a key governance benefit, preventing residual standing access after the assignment lifecycle ends.

    Why the other options are wrong

    • BManual cleanup is not required; entitlement management handles deprovisioning of package-granted access.
    • CBoth the group membership and the application assignment granted by the package are removed, not just the app.
    • DEnding one assignment does not block tenant-wide sign-in; it only removes the access that package provided.

Who this SC-300 practice exam is for

This practice set is for anyone preparing for the SC-300: Microsoft Identity and Access Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-300 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-300 exam.

Related Microsoft resources

• SC-300 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• SC-401 practice examRelated
• SC-500 practice examRelated
• SC-900 practice examRelated

SC-300 practice exam FAQ