SC-300 Microsoft Identity and Access Administrator v1.0 2 — Questions and Answers
Question 1: An organization wants to enforce that users can only access Microsoft 365 apps from devices that are Intune-compliant. Which Conditional Access grant control should be configured?
- Require multi-factor authentication
- Require device to be marked as compliant (Correct answer)
- Require Hybrid Azure AD joined device
- Require approved client app
Correct answer: Require device to be marked as compliant
The 'Require device to be marked as compliant' grant control ensures only Intune-compliant devices can access the specified apps.
Question 2: A security team needs to review all privileged role assignments in Azure AD on a quarterly basis. Which feature best automates this process?
- Azure AD Audit Logs
- Privileged Identity Management access reviews (Correct answer)
- Azure Policy compliance reports
- Microsoft Defender for Identity alerts
Correct answer: Privileged Identity Management access reviews
PIM access reviews allow automated recurring reviews of privileged role assignments by designated reviewers.
Question 3: A user reports they cannot reset their password using SSPR. Upon investigation, you find the user is not a member of any SSPR-enabled group. What is the quickest fix?
- Assign the user the Password Administrator role
- Enable SSPR for 'All users' or add the user to the enabled group (Correct answer)
- Create a new Conditional Access policy for the user
- Configure the user's authentication methods manually
Correct answer: Enable SSPR for 'All users' or add the user to the enabled group
SSPR scope must include the user, either by enabling it for all users or adding the user to the configured group.
Question 4: Which Azure AD identity governance feature allows external users to request access to internal resources through a defined approval workflow?
- B2B collaboration
- Entitlement management access packages (Correct answer)
- Conditional Access named locations
- Identity Protection risk policies
Correct answer: Entitlement management access packages
Entitlement management access packages let external users self-request access through configured approval workflows.
Question 5: An administrator needs to ensure that a service principal used by an application cannot be granted consent to access sensitive data by regular users. Which setting should be configured?
- Disable user consent for all applications
- Enable admin consent workflow and restrict user consent (Correct answer)
- Set the application to single-tenant
- Require MFA for service principals
Correct answer: Enable admin consent workflow and restrict user consent
Enabling the admin consent workflow and restricting user consent forces sensitive permission grants to require administrator approval.
Question 6: A Conditional Access policy is set to block access from 'Any location' except a named location called 'Corporate Network'. A user on the corporate network is still being blocked. What is the most likely cause?
- The policy applies to all cloud apps, not just the target app
- The named location IP ranges do not include the user's current IP (Correct answer)
- The user's device is not Hybrid Azure AD joined
- MFA registration is incomplete for the user
Correct answer: The named location IP ranges do not include the user's current IP
If the user's IP is not within the IP ranges defined in the named location, the exclusion will not match and the block applies.
Question 7: Which Azure AD feature allows an administrator to define a custom set of attributes that can be assigned to users to support authorization decisions?
- Extension attributes (directory extensions)
- Custom security attributes (Correct answer)
- Azure AD schema extensions via Graph API
- Claims mapping policies
Correct answer: Custom security attributes
Custom security attributes are strongly typed, reusable attributes defined by admins specifically for access control and authorization scenarios.
SC-300 Microsoft Identity and Access Administrator v1.0 2
An organization wants to enforce that users can only access Microsoft 365 apps from devices that are Intune-compliant.
Which Conditional Access grant control should be configured?