Microsoft Identity and Access Administrator v1.0 Flashcards
7 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft Identity and Access Administrator v1.0 flashcards as text
A global administrator delegates the ability to manage user accounts in a single administrative unit to a helpdesk team. Which role should be assigned scoped to that administrative unit?
Answer: Helpdesk Administrator scoped to the administrative unit
Helpdesk Administrator scoped to an administrative unit restricts the role to only the users within that administrative unit.
An enterprise application uses certificate-based authentication for its service principal. The certificate is about to expire. Which action prevents an authentication outage?
Answer: Upload a new certificate to the app registration before the old one expires
Uploading a new certificate to the app registration before expiry ensures continuous authentication without service interruption.
Which claim in a JWT access token issued by Azure AD uniquely identifies the tenant that issued the token?
Answer: tid
The 'tid' (tenant ID) claim uniquely identifies the Azure AD tenant that issued the token.
A user is assigned an eligible Global Administrator role in PIM. They activate it but are blocked by a Conditional Access policy requiring a compliant device. What should the administrator do?
Answer: Ensure the user activates the role from a compliant device or adjust the CA policy for PIM activation
PIM activation is subject to Conditional Access policies, so the user must meet the policy requirements (compliant device) or the policy scope must be adjusted.
An organization wants to monitor for users signing in from IP addresses associated with anonymous proxies. Which Azure AD Identity Protection risk detection type covers this scenario?
Answer: Anonymous IP address
The 'Anonymous IP address' risk detection fires when a sign-in originates from an IP associated with anonymous proxies or Tor networks.
When configuring Azure AD Connect for hybrid identity, which feature allows users to perform password reset on-premises and have it written back to on-premises AD immediately?
Answer: Password writeback
Password writeback allows passwords changed or reset in Azure AD (including via SSPR) to be written back to the on-premises Active Directory in real time.
An administrator wants to ensure that an application only receives a token when the calling user has explicitly granted consent and no admin consent has been pre-granted. Which consent model enforces this?
Answer: Per-user incremental consent without admin pre-consent
Incremental (dynamic) consent without admin pre-consent ensures each individual user must explicitly consent before the app receives tokens on their behalf.