SC-300: Microsoft Identity and Access Administrator — Questions and Answers

Question 1: Which role is required to create and manage access packages in Azure AD Entitlement Management?

Identity Governance Administrator or catalog owner/access package manager (Correct answer)
Security Administrator
User Administrator
Application Administrator

Correct answer: Identity Governance Administrator or catalog owner/access package manager

The Identity Governance Administrator can manage all entitlement management settings, while catalog owners and access package managers have delegated authority within their catalogs.

Question 2: An administrator needs to extend a user's expiring eligible role assignment without having the user re-activate. Which PIM action should the administrator take?

Delete and recreate the assignment
Convert the eligible assignment to an active assignment
Create a new eligible assignment with a new end date
Update the existing assignment's end date using the 'Extend' option (Correct answer)

Correct answer: Update the existing assignment's end date using the 'Extend' option

PIM provides an 'Extend' option on expiring assignments that allows administrators to push out the expiration date without interrupting the user's eligibility.

Question 3: In Entitlement Management, what happens when a connected organization user is no longer a member of the connected organization?

Their access packages remain active permanently
Their account is converted to a standard Azure AD member
Their assignments can be automatically removed based on the policy's expiration settings (Correct answer)
They are promoted to internal users

Correct answer: Their assignments can be automatically removed based on the policy's expiration settings

Entitlement Management's time-bound assignment policies ensure that access expires regardless of the user's organizational status, and expired assignments remove access automatically.

Question 4: What is the default maximum activation duration for a PIM role assignment?

1 hour
8 hours (Correct answer)
4 hours
24 hours

Correct answer: 8 hours

PIM's default maximum activation duration is 8 hours, though administrators can configure this value between 1 and 24 hours per role.

Question 5: What is a 'catalog' in Azure AD Entitlement Management?

A policy set for external user collaboration
A list of all Azure AD users in the tenant
An audit log of all access requests
A container for access packages and the resources they reference (Correct answer)

Correct answer: A container for access packages and the resources they reference

A catalog is a logical container that groups access packages and the resources they include, enabling delegation of access package management to specific catalog owners.

Question 6: An organization wants to allow users to register both MFA and SSPR information in a single registration experience. Which Azure AD feature enables this?

Authentication Methods policy
Combined security information registration (Correct answer)
Per-user MFA portal
Identity Protection registration policy

Correct answer: Combined security information registration

Combined security information registration provides a unified registration experience where users can register their MFA and SSPR authentication methods in a single workflow at aka.ms/mysecurityinfo.

Question 7: Which protocol does Azure AD use for modern authentication token issuance to support OAuth 2.0 flows?

SAML 2.0
Kerberos
WS-Federation
OpenID Connect (OIDC) (Correct answer)

Correct answer: OpenID Connect (OIDC)

OpenID Connect is the identity layer on top of OAuth 2.0 that Azure AD uses to issue ID tokens for modern authentication flows.

Question 8: An access package policy is configured with a 14-day expiration and no renewal. What happens to a user's access when the assignment expires?

The assignment is extended by another 14 days automatically
Access is automatically removed from all resources included in the access package (Correct answer)
The user's account is disabled
The user is prompted to re-request the access package

Correct answer: Access is automatically removed from all resources included in the access package

When an access package assignment expires, Entitlement Management automatically removes the user from all resource groups, apps, and sites included in that access package.

Question 9: Which report in Azure AD helps administrators identify users who have NOT registered for MFA?

Sign-in logs filtered by MFA result
Conditional Access policy report
Authentication methods activity report (Correct answer)
Azure AD audit logs

Correct answer: Authentication methods activity report

The Authentication methods activity report provides registration details including which users have or have not registered specific authentication methods, making it easy to identify gaps in MFA adoption.

Question 10: Which Azure AD feature allows an organization to invite users from external organizations to collaborate on internal resources without requiring them to have an Azure AD account?

Azure AD B2C
Azure AD B2B collaboration (Correct answer)
Azure AD External Identities cross-tenant sync
Azure AD Connect

Correct answer: Azure AD B2B collaboration

Azure AD B2B collaboration allows external users to sign in using their own credentials (social or corporate identity) and be granted access to the inviting organization's resources as guest users.

Question 11: Which Azure AD External Identities feature allows a completely separate consumer-facing identity store with custom sign-up and sign-in flows using social identities like Google and Facebook?

External Identities self-service sign-up
Azure AD B2C (Correct answer)
Azure AD B2B collaboration
Cross-tenant access settings

Correct answer: Azure AD B2C

Azure AD B2C is a separate identity platform designed for consumer-facing applications that supports custom sign-up and sign-in experiences with social identity providers and local accounts.

Question 12: An organization uses Azure AD Connect. After a recent change, some synchronized users cannot sign in to Azure AD. The administrator suspects an attribute sync issue. Which tool should be used first to diagnose the problem?

IdFix tool
Azure AD audit logs
Synchronization Service Manager (Correct answer)
Azure AD Connect Health

Correct answer: Synchronization Service Manager

Synchronization Service Manager shows connector errors and object-level sync details, making it the primary diagnostic tool for attribute sync issues.

Question 13: A security team wants to detect when an Azure AD privileged role is assigned outside of PIM. Which monitoring approach should they implement?

Azure Monitor alert on 'Add member to role' audit event outside PIM (Correct answer)
PIM access review
Identity Protection sign-in risk policy
Microsoft Secure Score recommendation

Correct answer: Azure Monitor alert on 'Add member to role' audit event outside PIM

Creating an Azure Monitor or Microsoft Sentinel alert on direct role assignment audit events (not initiated by PIM) catches privileged role assignments that bypass PIM controls.

Question 14: A company runs quarterly access reviews on all privileged directory roles. Which Azure AD feature is being used?

Conditional Access policies
Identity Protection user risk policies
Entitlement management access packages
PIM access reviews (Correct answer)

Correct answer: PIM access reviews

PIM includes built-in access review capabilities that allow periodic recertification of privileged directory role assignments to ensure least privilege is maintained.

Question 15: An organization has configured SAML/WS-Fed federation with a partner organization that uses a non-Azure identity provider. What is the benefit of this configuration?

Partner users can sign in to the host tenant using their existing corporate SSO credentials without needing a Microsoft account (Correct answer)
Partner users bypass all Conditional Access policies
Partner users can manage the host tenant's Azure resources
Partner users receive permanent member accounts in the host tenant

Correct answer: Partner users can sign in to the host tenant using their existing corporate SSO credentials without needing a Microsoft account

SAML/WS-Fed direct federation allows partner users to authenticate using their existing corporate identity provider, providing a seamless SSO experience without requiring Microsoft account creation.

Question 16: Which PIM setting limits how long an eligible role activation will remain active once approved?

Role expiration policy
Maximum activation duration (Correct answer)
Permanent eligible assignment
Assignment duration

Correct answer: Maximum activation duration

The 'Maximum activation duration' role setting caps how many hours an activated eligible role stays active before it automatically deactivates.

Question 17: An enterprise application uses certificate-based authentication for its service principal. The certificate is about to expire. Which action prevents an authentication outage?

Rotate the client secret before the certificate expires
Upload a new certificate to the app registration before the old one expires (Correct answer)
Renew the certificate using Azure Key Vault auto-rotation
Re-register the application with a new application ID

Correct answer: Upload a new certificate to the app registration before the old one expires

Uploading a new certificate to the app registration before expiry ensures continuous authentication without service interruption.

Question 18: An administrator configures an entitlement management access package with an approval workflow requiring two stages. What happens if the first approver does not respond within the configured timeout?

The request is automatically approved and moves to stage two
The requestor must resubmit the request
The request is automatically denied
The request escalates to the fallback approver defined in that stage (Correct answer)

Correct answer: The request escalates to the fallback approver defined in that stage

Entitlement management supports fallback approvers per stage; if the primary approver times out, the request escalates to the fallback approver.

Question 19: Which Azure AD setting controls which external domains are allowed or blocked from receiving B2B collaboration invitations?

External collaboration settings: Allow/deny list for domains (Correct answer)
Identity Protection sign-in risk policy
Cross-tenant access settings inbound configuration
Conditional Access external collaboration policy

Correct answer: External collaboration settings: Allow/deny list for domains

The external collaboration settings in Azure AD include an allow/deny list where administrators can specify which external domains are permitted or blocked from B2B collaboration.

Question 20: Which claim in a JWT access token issued by Azure AD uniquely identifies the tenant that issued the token?

iss
tid (Correct answer)
oid
sub

Correct answer: tid

The 'tid' (tenant ID) claim uniquely identifies the Azure AD tenant that issued the token.

Question 21: What does the 'Recommendations' feature in Access Reviews do?

It automatically approves all active users without reviewer input
It provides reviewers with data-driven approve or deny suggestions based on user sign-in activity (Correct answer)
It creates a Conditional Access policy based on review results
It generates a risk score for each user being reviewed

Correct answer: It provides reviewers with data-driven approve or deny suggestions based on user sign-in activity

The recommendations feature displays a suggested decision to reviewers based on signals such as whether the user has signed in recently, helping reviewers make informed decisions more efficiently.

Question 22: Which feature in Access Reviews allows a reviewer to look at a decision made by another reviewer and override it during the review period?

Decision justification
Decision recommendations
Reviewer fallback
Multi-stage reviews (Correct answer)

Correct answer: Multi-stage reviews

Multi-stage reviews in access reviews allow sequential reviewers to see prior decisions and override them in later stages, supporting a tiered review workflow.

Question 23: Which Azure AD feature allows bulk invitation of multiple guest users by uploading a CSV file?

Entitlement Management connected organizations
Microsoft Graph bulk invite API
Bulk invite users feature in the Azure portal (Correct answer)
Azure AD B2C custom policies

Correct answer: Bulk invite users feature in the Azure portal

The 'Bulk invite users' feature in the Azure portal allows administrators to upload a CSV file with external user email addresses and redirect URLs to send multiple B2B invitations simultaneously.

Question 24: Which Azure AD report helps administrators identify guest accounts that have not signed in for an extended period, enabling cleanup of stale external identities?

Identity Protection Risky Users report
Entitlement Management access package assignments report
Azure AD Sign-in logs filtered by UserType = Guest with last sign-in date (Correct answer)
Access reviews configured for guest users in groups

Correct answer: Azure AD Sign-in logs filtered by UserType = Guest with last sign-in date

Filtering Azure AD Sign-in logs or using the 'All users' blade with UserType = Guest and last sign-in date allows administrators to identify inactive guest accounts for review and removal.

Question 25: Which PIM setting ensures that a user must provide a business justification before activating an eligible Azure AD role?

Require MFA on activation
Require ticket information on activation
Require approval to activate
Require justification on activation (Correct answer)

Correct answer: Require justification on activation

The 'Require justification on activation' PIM role setting forces users to enter a justification reason before their role is activated.

Question 26: An administrator needs to restrict external B2B guest users from having access to the Azure AD administrative portals. Which approach accomplishes this?

Set the guest user default permissions to restrict all access
Configure a Conditional Access policy that blocks guest users from accessing the Azure portal and admin center (Correct answer)
Remove all Azure AD licenses from guest accounts
Delete all guest user accounts and re-invite with limited roles

Correct answer: Configure a Conditional Access policy that blocks guest users from accessing the Azure portal and admin center

A Conditional Access policy scoped to guest user accounts and targeting the Microsoft Azure Management cloud app can block external users from accessing administrative portal interfaces.

Question 27: What is the minimum Azure AD license required to create and use Conditional Access policies?

Azure AD Free
Azure AD Premium P1 (Correct answer)
Azure AD Premium P2
Microsoft 365 Business Basic

Correct answer: Azure AD Premium P1

Azure AD Premium P1 is the minimum license tier that includes Conditional Access policy functionality.

Question 28: A company acquires another organization and wants to allow the acquired company's Azure AD users to access resources in the parent company's tenant without converting them to guest accounts. Which feature enables this?

Azure AD cross-tenant synchronization (Correct answer)
Azure AD B2B direct connect with shared channels
Azure AD B2B collaboration guest invitations
Azure AD External Identities B2C

Correct answer: Azure AD cross-tenant synchronization

Cross-tenant synchronization automatically creates and maintains member (non-guest) user objects in the resource tenant synced from the source tenant.

Question 29: An organization wants to enable SMS sign-in for frontline workers who share workstations and do not have personal email addresses configured in Azure AD. What is a prerequisite for enabling SMS sign-in for a user?

The user must have a mobile phone number configured in their Azure AD profile (Correct answer)
The user must be assigned an Azure AD Premium P2 license
The user must have previously completed MFA registration
The user must have a Microsoft Authenticator app installed

Correct answer: The user must have a mobile phone number configured in their Azure AD profile

SMS sign-in requires that a mobile phone number be set on the user's Azure AD profile, as this number is used to send the one-time passcode for authentication.

Question 30: In Azure AD Privileged Identity Management, what is the difference between an 'eligible' assignment and an 'active' assignment?

Eligible assignments require approval; active assignments do not
Eligible assignments apply to groups; active assignments apply to users
Eligible users must activate their role before using it; active users have the role immediately without activation (Correct answer)
Eligible assignments are permanent; active assignments are time-limited

Correct answer: Eligible users must activate their role before using it; active users have the role immediately without activation

Eligible assignments require users to go through an activation process (with optional MFA and approval) before the role becomes active, whereas active assignments grant the role immediately.

SC-300: Microsoft Identity and Access Administrator

Validates skills in implementing and managing Microsoft Entra ID (formerly Azure AD) identity solutions, including user identities, authentication, access management, workload identities, and identity governance. Required for the Microsoft Certified: Identity and Access Administrator Associate credential.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds