SC-300 Microsoft Identity and Access Administrator Certification 3 — Questions and Answers
Question 1: A user reports they cannot activate their eligible PIM role because no approver is responding. Which PIM setting can prevent this scenario automatically after a set period?
- Approval timeout with auto-deny or configuring alternate approvers (Correct answer)
- Increasing the maximum activation duration
- Enabling MFA on activation
- Setting the role as permanently active
Correct answer: Approval timeout with auto-deny or configuring alternate approvers
Configuring alternate approvers or setting a timeout policy ensures activation requests are not indefinitely blocked when primary approvers are unavailable.
Question 2: Which Azure AD feature allows an administrator to define which authentication methods (FIDO2, TOTP, SMS) are available to users across the tenant?
- Authentication Methods policy (Correct answer)
- Conditional Access authentication strength
- Legacy MFA settings (per-user MFA portal)
- Identity Protection
Correct answer: Authentication Methods policy
The Authentication Methods policy blade in Azure AD centrally controls which authentication methods are enabled and for which user groups.
Question 3: An enterprise wants guest users from a partner tenant to use their home tenant MFA rather than the resource tenant's MFA. Which cross-tenant access setting enables this?
- Inbound trust settings to accept MFA claims from the partner tenant (Correct answer)
- Outbound access blocking for the partner tenant
- External collaboration settings to allow B2B invitations
- Conditional Access policy targeting guests
Correct answer: Inbound trust settings to accept MFA claims from the partner tenant
Inbound cross-tenant access trust settings allow you to trust MFA claims from a specific external Azure AD tenant, avoiding dual MFA prompts.
Question 4: A company deploys Azure AD Password Protection on-premises. Which component on domain controllers enforces the banned password list?
- Azure AD Password Protection DC Agent (Correct answer)
- Azure AD Connect cloud sync
- Microsoft Entra Private Access
- Azure AD Application Proxy connector
Correct answer: Azure AD Password Protection DC Agent
The DC Agent service installed on each domain controller intercepts password change events and validates passwords against the global and custom banned password lists.
Question 5: Which claim in a JSON Web Token (JWT) represents the unique identifier of the user in Azure AD?
- oid (object ID) (Correct answer)
- sub (subject)
- upn (user principal name)
- tid (tenant ID)
Correct answer: oid (object ID)
The 'oid' claim contains the immutable object ID of the user in Azure AD and is the recommended identifier for linking tokens to user accounts.
Question 6: An admin must ensure that only Intune-compliant devices can access Exchange Online. Which component combination is required?
- Conditional Access policy + Intune compliance policy (Correct answer)
- Azure AD Identity Protection + device registration
- Microsoft Defender for Endpoint + app protection policy
- MCAS session policy + Conditional Access
Correct answer: Conditional Access policy + Intune compliance policy
A Conditional Access policy with a device compliance grant condition, combined with an Intune compliance policy defining the compliance rules, enforces device health requirements.
Question 7: In Azure AD Entitlement Management, what is the purpose of a 'connected organization'?
- To allow external users from specified domains to request access packages (Correct answer)
- To federate with another Azure AD tenant for SSO
- To configure cross-tenant synchronization
- To establish a trust relationship for PIM approvals
Correct answer: To allow external users from specified domains to request access packages
A connected organization in Entitlement Management defines a trusted external Azure AD tenant or domain whose users can be eligible to request access packages.
SC-300 Microsoft Identity and Access Administrator Certification 3
A user reports they cannot activate their eligible PIM role because no approver is responding.
Which PIM setting can prevent this scenario automatically after a set period?