Microsoft Identity and Access Administrator Dumps Flashcards
7 cards from real SC-300 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft Identity and Access Administrator Dumps flashcards as text
A developer registers a multi-tenant application in Azure AD. A user from a different Azure AD tenant attempts to consent to the application but is blocked. What is the most likely cause?
Answer: The external tenant has admin consent required for all applications and no admin has consented
If the external tenant requires admin consent for all apps, individual users cannot consent, and an administrator must grant tenant-wide consent first.
Which hybrid identity authentication method allows password hash synchronization to Azure AD while also supporting on-premises authentication policies like account lockout and hours restrictions?
Answer: Pass-through Authentication (PTA)
Pass-through Authentication validates credentials against on-premises AD in real time, so on-premises policies like lockout and logon hours are enforced.
An administrator configures an entitlement management access package with an approval workflow requiring two stages. What happens if the first approver does not respond within the configured timeout?
Answer: The request escalates to the fallback approver defined in that stage
Entitlement management supports fallback approvers per stage; if the primary approver times out, the request escalates to the fallback approver.
Which Azure AD Conditional Access policy component determines WHO the policy applies to?
Answer: Assignments — Users and groups
The 'Assignments — Users and groups' section of a Conditional Access policy defines which users, groups, or roles the policy targets.
A global administrator wants to prevent any other administrator from removing the MFA requirement on a critical Conditional Access policy. Which feature provides this protection?
Answer: Setting the policy as a protected action requiring re-authentication with Conditional Access
Protected actions in Azure AD require re-authentication (with elevated Conditional Access) to perform sensitive operations like modifying specific policies, adding extra friction.
An organization wants to federate their on-premises AD DS with Azure AD using AD FS. Which certificate must be shared with Azure AD to establish the federation trust?
Answer: The AD FS token-signing certificate
The token-signing certificate is used to sign SAML tokens issued by AD FS; Azure AD needs the public key to verify those tokens.
A user's Identity Protection sign-in risk is detected as 'medium' due to an atypical travel alert. The Conditional Access policy for medium risk requires MFA. The user completes MFA. What happens to the risk level after successful MFA?
Answer: The risk level remains 'medium' until an administrator manually dismisses it
Completing MFA satisfies the Conditional Access requirement but does not automatically clear the Identity Protection risk; an administrator must dismiss it or the user must remediate via SSPR.