Microsoft Identity and Access Administrator SC-300 Exam Guide

Lesson 1 • Azure AD Licensing and Service Tiers

Compares Free, P1, and P2 feature sets and maps features to exam objectives. Enables accurate feature selection when designing identity solutions.

Lesson 2 • Azure Active Directory Architecture

Explains Azure AD tenants, directories, subscriptions, and object types. Connects directory structure to access control decisions made throughout the course.

Lesson 3 • Microsoft Identity Platform Overview

Surveys the Microsoft identity platform, OAuth 2.0, and OpenID Connect flows. Grounds students in the protocols that underpin all Azure AD authentication scenarios.

Lesson 1 • Identity Lifecycle Automation

Implements HR-driven provisioning and lifecycle workflows using Azure AD and Lifecycle Workflows. Reduces manual effort and enforces consistent joiner-mover-leaver processes.

Lesson 2 • External Identities and B2B Collaboration

Configures guest user invitations, cross-tenant access settings, and B2B direct connect. Extends secure collaboration beyond organizational boundaries.

Lesson 3 • Administrative Units and Delegated Management

Uses administrative units to scope admin roles to subsets of users and groups. Supports least-privilege delegation in large, multi-department tenants.

Lesson 4 • Group Types and Dynamic Membership

Covers security groups, Microsoft 365 groups, and dynamic membership rules. Enables automated group population based on user attributes.

Lesson 1 • Monitoring and Troubleshooting Synchronization

Uses Azure AD Connect Health, sync logs, and error reports to diagnose sync failures. Maintains directory consistency and minimizes identity-related service disruptions.

Lesson 2 • Azure AD Cloud Sync Deployment

Deploys the lightweight cloud sync agent for multi-forest and disconnected scenarios. Complements Azure AD Connect where full agent deployment is impractical.

Lesson 3 • Hybrid Identity Architecture and Options

Compares password hash sync, pass-through authentication, and federation topologies. Guides architecture decisions based on security, availability, and compliance requirements.

Lesson 1 • Passwordless Authentication Methods

Deploys FIDO2 security keys, Microsoft Authenticator passwordless, and Windows Hello for Business. Eliminates password-based attack surfaces for high-value accounts.

Lesson 2 • Authentication Method Policies and Monitoring

Manages the Authentication Methods policy blade and migration from legacy MFA settings. Provides centralized control and audit visibility over all authentication methods.

Lesson 3 • Self-Service Password Reset Setup

Configures SSPR authentication methods, registration campaigns, and writeback to on-premises AD. Reduces helpdesk load while maintaining secure password recovery.

Lesson 1 • Monitoring and Reporting Access Decisions

Analyzes sign-in logs, Conditional Access insights, and Identity Protection reports. Validates policy effectiveness and identifies gaps in access control coverage.

Lesson 2 • Conditional Access Policy Design

Builds policies using users, cloud apps, conditions, and grant controls. Translates business security requirements into enforceable access rules.

Lesson 3 • Advanced Conditional Access Scenarios

Implements authentication strength, continuous access evaluation, and token protection. Addresses sophisticated attack vectors beyond basic MFA enforcement.

Lesson 1 • Enterprise Application SSO Configuration

Configures SAML, OIDC, and password-based SSO for gallery and non-gallery apps. Delivers seamless user access while centralizing authentication control.

Lesson 2 • Application Registration in Azure AD

Creates app registrations, configures redirect URIs, and manages certificates and secrets. Establishes the identity foundation for custom and third-party applications.

Lesson 3 • Application Governance and Access Reviews

Applies app governance policies, consent phishing detection, and access reviews for apps. Reduces overprivileged application access and enforces periodic recertification.

Lesson 4 • App Provisioning with SCIM

Configures automatic user provisioning to SaaS apps using the SCIM protocol. Synchronizes identity lifecycle events from Azure AD to connected applications.

Lesson 1 • Privileged Identity Management for Azure AD Roles

Activates, assigns, and audits eligible Azure AD role assignments using PIM. Enforces just-in-time access and approval gates for privileged directory roles.

Lesson 2 • Terms of Use and Conditional Access Integration

Creates terms-of-use policies and enforces acceptance via Conditional Access. Provides legal and compliance documentation of user consent to access conditions.

Lesson 3 • PIM for Azure Resource Roles

Extends PIM governance to Azure subscription and resource roles. Applies just-in-time and time-bound access controls to cloud infrastructure permissions.

Lesson 4 • Entitlement Management and Access Packages

Creates catalogs, access packages, and policies for automated access request and approval. Enables self-service access while enforcing approval workflows and expiration.

Lesson 1 • SC-300 Exam Scenario Practice

Applies all SC-300 domains through end-to-end scenario labs and practice questions. Consolidates knowledge and identifies remaining gaps before the certification exam.

Lesson 2 • Identity Secure Score and Recommendations

Interprets the Identity Secure Score and prioritizes improvement actions. Provides a measurable baseline for continuous identity security posture improvement.

Lesson 3 • Azure AD Audit and Sign-In Log Management

Configures diagnostic settings to route logs to Log Analytics, Storage, and Event Hubs. Enables long-term retention and cross-service correlation of identity events.