Exams

SC-300

Microsoft Identity and Access Administrator

A free study hub for Microsoft identity and access administration, built around Microsoft Entra, Zero Trust, Conditional Access, workload identities, and identity governance.

Last updated: 10 May 2026

Start quiz Open 30 day cram guide Download ebook Donate

Objective map

Use this as the content checklist when Microsoft updates the exam.

Implement and manage user identities

20 to 25 percent

Microsoft Entra tenant settings, roles, administrative units, domains, branding, and device settings
Users, groups, custom security attributes, bulk operations, device registration, and licensing
External collaboration, guest users, cross tenant access, cross tenant synchronisation, and external identity providers
Microsoft Entra Connect Sync, Cloud Sync, password hash synchronisation, pass through authentication, seamless SSO, AD FS migration, and Connect Health

Implement authentication and access management

25 to 30 percent in the summary, with a section heading currently showing 20 to 25 percent

Authentication methods, Temporary Access Pass, OAuth 2.0 tokens, Microsoft Authenticator, passkeys, MFA, SSPR, Windows Hello for Business, account disablement, session revocation, password protection, and Microsoft Entra Kerberos
Conditional Access assignments, controls, testing, troubleshooting, session management, device restrictions, continuous access evaluation, authentication context, protected actions, and templates
Microsoft Entra ID Protection for user risk, sign in risk, MFA registration, risky users, risky sign ins, and risky workload identities
Global Secure Access clients, Private Access, Internet Access, and Internet Access for Microsoft 365

Plan and implement workload identities

20 to 25 percent

Managed identities, service principals, user accounts, managed service accounts, and Azure resource access
Enterprise application settings, app roles, on premises app publishing with Microsoft Entra Application Proxy, SaaS app integration, assignment, classification, consent, and app collections
App registrations, authentication, API permissions, and app roles
Microsoft Defender for Cloud Apps discovery, connected apps, application restrictions, Conditional Access app control, policies for OAuth apps, and the Cloud app catalog

Plan and automate identity governance

20 to 25 percent

Entitlement management, catalogues, access packages, requests, terms of use, external user lifecycle, and connected organisations
Access review planning, configuration, monitoring, and manual responses
Privileged Identity Management for Microsoft Entra roles, Azure resources, groups, approvals, audit history, reports, and break glass accounts
Sign in logs, audit logs, provisioning logs, diagnostic settings, Log Analytics, KQL, workbooks, reports, and Identity Secure Score

Case studies

Practise reading the business context, constraints, and requirements before answering. These are original scenarios based on the SC-300 objective style.

Liver ShippingDelegated administration and Conditional Access

Overview

Liver Shipping operates port offices in Liverpool, Belfast, and Cardiff. The central IT team owns identity design, but each port has a local support team that handles first line account issues.

Identity environment

The tenant uses Microsoft Entra ID with Microsoft 365 E5 licences.
Users are grouped by port and department.
The helpdesk team must reset passwords only for users in its own port.
Two emergency access accounts are excluded from normal Conditional Access policies and are monitored.

Cloud environment

SharePoint Online is used for port operations documents.
A finance application is integrated as an enterprise application.
Sign in logs are sent to a Log Analytics workspace.

Requirements

Use least privilege for delegated administration.
Require MFA outside trusted port office locations.
Test new Conditional Access policies before enforcement.
Keep evidence for sign in troubleshooting.

User identities

You need to allow the Belfast helpdesk to reset passwords only for Belfast users. What should you configure first?

A tenant wide User Administrator role assignmentAn administrative unit that contains the Belfast usersA new verified domain for BelfastA Conditional Access authentication context

Administrative units let you scope supported role assignments to a defined set of users or groups.

Conditional Access

You need to validate the MFA policy before users are affected. What should you use?

Report only modeSecurity defaults onlyA guest invitation policyA custom security attribute

Report only mode lets you evaluate Conditional Access impact before turning on enforcement.

Monitoring

Which two sources should you review to troubleshoot Conditional Access results for a user sign in?

Blink IncPasswordless onboarding and risk based access

Overview

Blink Inc is moving product and engineering teams to passwordless sign in. The support team must onboard new starters without issuing long lived temporary passwords.

Identity environment

All employees use Microsoft Entra ID for Microsoft 365 and SaaS access.
New starters receive managed devices but have no registered authentication methods on day one.
The security team wants to reduce risky sign ins and prompt users to register strong methods.

Cloud environment

The company uses Microsoft Authenticator and passkeys where supported.
Several SaaS apps use enterprise application SSO.
Risk detections are reviewed daily.

Requirements

Provide a secure onboarding method for passwordless registration.
Require MFA for risky sign ins.
Avoid permanent shared credentials.
Use clear evidence when support investigates blocked access.

Authentication

You need to let a new starter register Microsoft Authenticator without issuing a permanent password. What should you create?

A Temporary Access PassA shared emergency access accountA custom domainAn app role assignment

Temporary Access Pass is suited to secure onboarding and recovery scenarios.

Identity Protection

You need to respond automatically when a user has high sign in risk. What should you configure?

A risk based Conditional Access policyA company branding settingA Microsoft Entra Connect staging serverAn app collection

Risk based Conditional Access can use sign in risk as a condition.

Authentication methods

Which two items should you review before enforcing passwordless registration?

Authentication methods policyUser registration statusSharePoint site logoVerified domain MX record

Authentication methods policy controls available methods, and registration status shows readiness.

Mill Town EngineeringHybrid identity, workload identity, and privileged access

Overview

Mill Town Engineering runs AD DS on premises and Azure workloads for design automation. Engineers need secure access to resources without storing secrets in scripts.

Identity environment

AD DS users are synchronised to Microsoft Entra ID.
Privileged administrators currently have standing role assignments.
Automation jobs access Azure Key Vault and storage accounts.

Cloud environment

Azure resources are spread across production and test subscriptions.
A Log Analytics workspace stores Microsoft Entra sign in and audit logs.
PIM has been enabled but not fully configured.

Requirements

Reduce standing privileged access.
Avoid secrets in automation code.
Monitor role activation and sign in activity.
Keep hybrid sign in resilient.

Workload identities

You need an Azure automation process to access Key Vault without storing a secret in code. What should you use?

A managed identityA shared user accountA guest accountA terms of use policy

Managed identities allow supported Azure resources to authenticate without secrets in code.

Privileged access

You need administrators to activate roles only when required. What should you configure?

Eligible assignments in PIMCompany brandingA permanent Global Administrator assignmentA custom domain

PIM eligible assignments reduce standing privilege and support activation controls.

Hybrid identity

Which two features should you compare when choosing how to synchronise AD DS identities?

Microsoft Entra Connect SyncMicrosoft Entra Cloud SyncApplication Proxy brandingIdentity Secure Score only

Microsoft Entra Connect Sync and Cloud Sync are the main synchronisation options to compare.

Whippet ExportsExternal collaboration and identity governance

Overview

Whippet Exports works with freight brokers, customs agents, and temporary warehouse partners. Partner access must be easy to request but removed when work ends.

Identity environment

Partners access Teams, SharePoint Online, and a customs tracking application.
Guest users are currently invited manually by project managers.
Some partner organisations use their own Microsoft Entra tenants.

Cloud environment

The customs tracking application uses Microsoft Entra enterprise application assignment.
Access reviews are available but not scheduled.
Entitlement management is licensed.

Requirements

Use an approval process for partner access.
Remove access automatically when the project ends.
Review guest access every month.
Use cross tenant access settings for trusted partner tenants.

Identity governance

You need partners to request access to Teams and SharePoint resources with approval and expiry. What should you create?

An access packageA permanent guest accountA custom domainA device join policy

Access packages support governed requests, approvals, expiry, and lifecycle management.

External identities

You need to control inbound collaboration from a trusted partner tenant. What should you configure?

Cross tenant access settingsA Log Analytics workspaceCompany brandingA managed identity

Cross tenant access settings control inbound and outbound collaboration with other Microsoft Entra tenants.

Access reviews

Which two settings should you define for a monthly guest access review?

Review scopeReviewersTenant display nameApplication secret value

Access reviews require a target scope and reviewers, along with recurrence and outcome settings.

Study material

How to read an SC-300 case study

Start with the overview, then separate identity environment, cloud environment, requirements, and constraints. Most questions ask for the option that meets every requirement with the least privilege and fewest operational changes.

Example company: All companies

Delegated administration

Look for scope words such as only, specific department, region, or business unit. These often point towards administrative units, scoped role assignment, or group based design rather than tenant wide administrator roles.

Example company: Liver Shipping

Authentication and risk

For onboarding and recovery, compare Temporary Access Pass, authentication methods policy, registration campaigns, and SSPR. For risky access, look for user risk, sign in risk, and Conditional Access policy controls.

Example company: Blink Inc

Workload and privileged identities

For Azure workloads, prefer managed identities where supported. For administrators, prefer PIM eligible assignments, activation controls, approval, justification, and audit history over permanent broad roles.

Example company: Mill Town Engineering

Governed external access

For partner access, compare guest invitations, cross tenant access settings, entitlement management, connected organisations, access packages, lifecycle settings, and access reviews.

Example company: Whippet Exports

Prepare for the exam

Choose a course section and work through the practice questions. Each section is designed to hold 50 questions.

Explore identity in Microsoft Entra ID50 questions

Module | 48 min

Identity basics, Zero Trust, Microsoft Entra services, authentication, authorisation, tokens, licensing, and auditing.

Zero Trust

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. What should you recommend?

Use identity, device, risk, and application signals to verify each access requestDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Zero Trust relies on explicit verification, least privilege, and assumed breach. Identity is a core control point.

Authentication and authorisation

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. What should you recommend?

Grant Global Administrator to all support staffTreat authentication as proof of identity and authorisation as the access decisionTreat an ID token as a long term passwordUse licence assignment as the access decision

Authentication and authorisation are separate. A successful sign in does not automatically grant access to every app.

Tokens and claims

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. What should you recommend?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensUse the access token to call the protected APIBlock all users without testing

Access tokens are presented to APIs. ID tokens describe the signed in user to the client application.

Microsoft Entra services

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. What should you recommend?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountUse Microsoft Entra External ID collaboration features

External identity features support collaboration without creating standard employee accounts for every partner.

Identity licensing

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. What should you recommend?

Check the Microsoft Entra licence requirements for the featureDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Some identity protection and governance features depend on licensing. Licence checks prevent a design that cannot be deployed.

Audit evidence

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. What should you recommend?

Grant Global Administrator to all support staffReview Microsoft Entra audit logsTreat an ID token as a long term passwordUse licence assignment as the access decision

Audit logs show directory and configuration changes. Sign in logs show sign in activity.

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. What should you recommend?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensReview the sign in log entry for Conditional Access resultsBlock all users without testing

Identity as control plane

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. What should you recommend?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountCentralise access decisions through Microsoft Entra identities and policies

Identity is a control plane because it governs access across users, apps, devices, and workloads.

Least privilege

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. What should you recommend?

Assign the narrowest built in Microsoft Entra role that meets the taskDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Microsoft exams often include an over privileged answer. Least privilege usually removes it.

Exam reading

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. What should you recommend?

Grant Global Administrator to all support staffRead the requirement and constraint sections before selecting an answerTreat an ID token as a long term passwordUse licence assignment as the access decision

SC-300 case questions reward careful reading. The best answer must satisfy every constraint, not just the headline task.

Zero Trust

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. What should you do first?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensIdentify the signals that will be available at sign inBlock all users without testing

Zero Trust relies on explicit verification, least privilege, and assumed breach. Identity is a core control point.

Authentication and authorisation

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. What should you do first?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountConfirm whether sign in succeeded before checking app access

Authentication and authorisation are separate. A successful sign in does not automatically grant access to every app.

Tokens and claims

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. What should you do first?

Check the requested scopes or application permissionsDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Access tokens are presented to APIs. ID tokens describe the signed in user to the client application.

Microsoft Entra services

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. What should you do first?

Grant Global Administrator to all support staffConfirm whether the partner users are guests or from another tenantTreat an ID token as a long term passwordUse licence assignment as the access decision

External identity features support collaboration without creating standard employee accounts for every partner.

Identity licensing

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. What should you do first?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensList the required features and map each one to licensingBlock all users without testing

Some identity protection and governance features depend on licensing. Licence checks prevent a design that cannot be deployed.

Audit evidence

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. What should you do first?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountIdentify the object and approximate time of the change

Audit logs show directory and configuration changes. Sign in logs show sign in activity.

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. What should you do first?

Collect the user, app, time, and correlation detailsDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Identity as control plane

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. What should you do first?

Grant Global Administrator to all support staffInventory users, applications, workload identities, and privileged rolesTreat an ID token as a long term passwordUse licence assignment as the access decision

Identity is a control plane because it governs access across users, apps, devices, and workloads.

Least privilege

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. What should you do first?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensIdentify the exact task the support user must performBlock all users without testing

Microsoft exams often include an over privileged answer. Least privilege usually removes it.

Exam reading

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. What should you do first?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountUnderline words such as first, only, least privilege, and without affecting users

SC-300 case questions reward careful reading. The best answer must satisfy every constraint, not just the headline task.

Zero Trust

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. Which source should you use to confirm the result?

Sign in logs with Conditional Access resultsDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Zero Trust relies on explicit verification, least privilege, and assumed breach. Identity is a core control point.

Authentication and authorisation

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. Which source should you use to confirm the result?

Grant Global Administrator to all support staffSign in logs and enterprise application assignment detailsTreat an ID token as a long term passwordUse licence assignment as the access decision

Authentication and authorisation are separate. A successful sign in does not automatically grant access to every app.

Tokens and claims

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. Which source should you use to confirm the result?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensToken claims and app registration API permission settingsBlock all users without testing

Access tokens are presented to APIs. ID tokens describe the signed in user to the client application.

Microsoft Entra services

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. Which source should you use to confirm the result?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountExternal user properties and cross tenant access settings

External identity features support collaboration without creating standard employee accounts for every partner.

Identity licensing

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. Which source should you use to confirm the result?

The Microsoft Entra admin centre licence and feature availability informationDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Some identity protection and governance features depend on licensing. Licence checks prevent a design that cannot be deployed.

Audit evidence

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. Which source should you use to confirm the result?

Grant Global Administrator to all support staffAudit logsTreat an ID token as a long term passwordUse licence assignment as the access decision

Audit logs show directory and configuration changes. Sign in logs show sign in activity.

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. Which source should you use to confirm the result?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensSign in logsBlock all users without testing

Identity as control plane

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. Which source should you use to confirm the result?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountDirectory roles, enterprise apps, and workload identity sign in data

Identity is a control plane because it governs access across users, apps, devices, and workloads.

Least privilege

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. Which source should you use to confirm the result?

Role assignment and audit logsDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Microsoft exams often include an over privileged answer. Least privilege usually removes it.

Exam reading

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. Which source should you use to confirm the result?

Grant Global Administrator to all support staffThe case study overview, requirements, and sign in evidence where providedTreat an ID token as a long term passwordUse licence assignment as the access decision

SC-300 case questions reward careful reading. The best answer must satisfy every constraint, not just the headline task.

Zero Trust

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. Which option meets the requirement with the least privilege?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensUse least privilege and explicit verification rather than broad network trustBlock all users without testing

Zero Trust relies on explicit verification, least privilege, and assumed breach. Identity is a core control point.

Authentication and authorisation

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. Which option meets the requirement with the least privilege?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountAssign only the application access the user needs

Authentication and authorisation are separate. A successful sign in does not automatically grant access to every app.

Tokens and claims

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. Which option meets the requirement with the least privilege?

Grant only the scopes or permissions required by the appDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Access tokens are presented to APIs. ID tokens describe the signed in user to the client application.

Microsoft Entra services

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. Which option meets the requirement with the least privilege?

Grant Global Administrator to all support staffUse external identities instead of normal employee accounts for partnersTreat an ID token as a long term passwordUse licence assignment as the access decision

External identity features support collaboration without creating standard employee accounts for every partner.

Identity licensing

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. Which option meets the requirement with the least privilege?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensUse only controls covered by the tenant licence or plan an upgradeBlock all users without testing

Some identity protection and governance features depend on licensing. Licence checks prevent a design that cannot be deployed.

Audit evidence

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. Which option meets the requirement with the least privilege?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountGrant log review access only to staff who investigate identity events

Audit logs show directory and configuration changes. Sign in logs show sign in activity.

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. Which option meets the requirement with the least privilege?

Allow support to read sign in logs without assigning broad admin rolesDisable sign in logging during rolloutUse Azure RBAC to prove the user passwordUse a custom domain as an authentication method

Identity as control plane

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. Which option meets the requirement with the least privilege?

Grant Global Administrator to all support staffUse scoped roles and app permissions instead of shared accountsTreat an ID token as a long term passwordUse licence assignment as the access decision

Identity is a control plane because it governs access across users, apps, devices, and workloads.

Least privilege

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. Which option meets the requirement with the least privilege?

Store audit evidence in the tenant display nameUse a guest invitation policy to classify tokensUse a task specific role instead of Global AdministratorBlock all users without testing

Microsoft exams often include an over privileged answer. Least privilege usually removes it.

Exam reading

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. Which option meets the requirement with the least privilege?

Trust all requests from the corporate networkUse company branding as the security boundaryCreate one shared administrator accountPick the answer that meets every constraint with the fewest permissions

SC-300 case questions reward careful reading. The best answer must satisfy every constraint, not just the headline task.

Zero Trust

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. Which two choices should be included?

Use identity, device, risk, and application signals to verify each access requestDisable sign in logging during rolloutSign in logs with Conditional Access resultsUse Azure RBAC to prove the user password

Zero Trust relies on explicit verification, least privilege, and assumed breach. Identity is a core control point.

Authentication and authorisation

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. Which two choices should be included?

Treat authentication as proof of identity and authorisation as the access decisionGrant Global Administrator to all support staffSign in logs and enterprise application assignment detailsTreat an ID token as a long term password

Authentication and authorisation are separate. A successful sign in does not automatically grant access to every app.

Tokens and claims

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. Which two choices should be included?

Use the access token to call the protected APIStore audit evidence in the tenant display nameToken claims and app registration API permission settingsUse a guest invitation policy to classify tokens

Access tokens are presented to APIs. ID tokens describe the signed in user to the client application.

Microsoft Entra services

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. Which two choices should be included?

Use Microsoft Entra External ID collaboration featuresTrust all requests from the corporate networkExternal user properties and cross tenant access settingsUse company branding as the security boundary

External identity features support collaboration without creating standard employee accounts for every partner.

Identity licensing

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. Which two choices should be included?

Check the Microsoft Entra licence requirements for the featureDisable sign in logging during rolloutThe Microsoft Entra admin centre licence and feature availability informationUse Azure RBAC to prove the user password

Some identity protection and governance features depend on licensing. Licence checks prevent a design that cannot be deployed.

Audit evidence

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. Which two choices should be included?

Review Microsoft Entra audit logsGrant Global Administrator to all support staffAudit logsTreat an ID token as a long term password

Audit logs show directory and configuration changes. Sign in logs show sign in activity.

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. Which two choices should be included?

Review the sign in log entry for Conditional Access resultsStore audit evidence in the tenant display nameSign in logsUse a guest invitation policy to classify tokens

Identity as control plane

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. Which two choices should be included?

Centralise access decisions through Microsoft Entra identities and policiesTrust all requests from the corporate networkDirectory roles, enterprise apps, and workload identity sign in dataUse company branding as the security boundary

Identity is a control plane because it governs access across users, apps, devices, and workloads.

Least privilege

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. Which two choices should be included?

Assign the narrowest built in Microsoft Entra role that meets the taskDisable sign in logging during rolloutRole assignment and audit logsUse Azure RBAC to prove the user password

Microsoft exams often include an over privileged answer. Least privilege usually removes it.

Exam reading

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. Which two choices should be included?

Read the requirement and constraint sections before selecting an answerGrant Global Administrator to all support staffThe case study overview, requirements, and sign in evidence where providedTreat an ID token as a long term password

SC-300 case questions reward careful reading. The best answer must satisfy every constraint, not just the headline task.

Implement an identity management solution using Microsoft Entra ID50 questions

Learning Path | 4 hr 16 min

Tenant setup, users, groups, external identities, and hybrid identity.

Tenant settings

Liver Shipping is standardising its Microsoft Entra tenant. The team must review settings that affect users, groups, devices, roles, domains, and branding. The answer must cover tenant level configuration. What should you recommend?

Review tenant properties, user settings, group settings, device settings, domains, roles, and company brandingUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Tenant configuration covers several settings. The exam may hide the answer behind a mix of domains, users, groups, devices, and roles.

Administrative units

Liver Shipping has helpdesk teams in separate port offices. The Belfast helpdesk must reset passwords only for Belfast users. The team must not manage users in other ports. What should you recommend?

Disable audit logs before migrationCreate an administrative unit for Belfast users and assign a supported scoped roleCreate all partner users as employeesUse terms of use as the sync engine

Administrative units scope supported role assignments to a subset of directory objects.

Microsoft Entra roles

Blink Inc is delegating application administration. A user must create and manage enterprise applications but must not manage all tenant settings. The answer must follow least privilege. What should you recommend?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityAssign an application focused Microsoft Entra role that matches the required tasksMake every helpdesk user Privileged Role Administrator

Built in roles are preferred when they meet the task. Global Administrator is usually too broad.

Users and bulk operations

Mill Town Engineering is onboarding 200 contractors. The identity team must create users efficiently and consistently. Manual one by one creation should be avoided. What should you recommend?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationUse bulk user operations or PowerShell for repeatable account creation

Bulk operations and PowerShell reduce manual errors when many identities must be created or updated.

Groups and licences

Blink Inc assigns Microsoft 365 licences by department. Licences must follow group membership and show assignment errors. The answer must not rely on manual licence assignment for every user. What should you recommend?

Use group based licensing and monitor assignment errorsUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Group based licensing is used when membership should drive licence assignment.

Custom security attributes

Whippet Exports classifies partner users by broker type. The attribute must support consistent classification in Microsoft Entra. The answer must not overload the display name field. What should you recommend?

Disable audit logs before migrationUse custom security attributes for the classification where supportedCreate all partner users as employeesUse terms of use as the sync engine

Custom security attributes provide structured classification data for supported scenarios.

Device join and registration

Blink Inc is tightening access from managed and personal devices. The team must understand device identity state before writing access policy. The answer must distinguish joined and registered devices. What should you recommend?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityReview Microsoft Entra joined, registered, and hybrid joined device statesMake every helpdesk user Privileged Role Administrator

Device state can be an access signal, but device registration is not the same as compliance.

External users

Whippet Exports invites customs brokers to collaborate. The company must control guest access without creating employee accounts. The answer must support partner lifecycle management. What should you recommend?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationUse guest users with external collaboration controls

External collaboration settings and guest users are central to partner access scenarios.

Cross tenant access

Whippet Exports works with a partner that has its own Microsoft Entra tenant. Inbound collaboration must be controlled for that partner tenant. The answer must distinguish inbound and outbound access. What should you recommend?

Configure organisation specific cross tenant access settingsUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Cross tenant access settings control collaboration between Microsoft Entra tenants.

Hybrid identity

Mill Town Engineering synchronises AD DS users to Microsoft Entra ID. The team must choose the right synchronisation and authentication design. The answer must account for existing on premises identity. What should you recommend?

Disable audit logs before migrationEvaluate Microsoft Entra Connect Sync, Cloud Sync, password hash synchronisation, pass through authentication, and seamless SSOCreate all partner users as employeesUse terms of use as the sync engine

Hybrid identity questions often test sync engine choice, authentication method, and health monitoring.

Tenant settings

Liver Shipping is standardising its Microsoft Entra tenant. The team must review settings that affect users, groups, devices, roles, domains, and branding. The answer must cover tenant level configuration. What should you do first?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityConfirm the current tenant settings and assigned admin rolesMake every helpdesk user Privileged Role Administrator

Tenant configuration covers several settings. The exam may hide the answer behind a mix of domains, users, groups, devices, and roles.

Administrative units

Liver Shipping has helpdesk teams in separate port offices. The Belfast helpdesk must reset passwords only for Belfast users. The team must not manage users in other ports. What should you do first?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationCreate or identify the administrative unit scope

Administrative units scope supported role assignments to a subset of directory objects.

Microsoft Entra roles

Blink Inc is delegating application administration. A user must create and manage enterprise applications but must not manage all tenant settings. The answer must follow least privilege. What should you do first?

Identify the tasks and compare them to built in role permissionsUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Built in roles are preferred when they meet the task. Global Administrator is usually too broad.

Users and bulk operations

Mill Town Engineering is onboarding 200 contractors. The identity team must create users efficiently and consistently. Manual one by one creation should be avoided. What should you do first?

Disable audit logs before migrationPrepare the user source data and required attributesCreate all partner users as employeesUse terms of use as the sync engine

Bulk operations and PowerShell reduce manual errors when many identities must be created or updated.

Groups and licences

Blink Inc assigns Microsoft 365 licences by department. Licences must follow group membership and show assignment errors. The answer must not rely on manual licence assignment for every user. What should you do first?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityCreate or identify the group that represents the licence populationMake every helpdesk user Privileged Role Administrator

Group based licensing is used when membership should drive licence assignment.

Custom security attributes

Whippet Exports classifies partner users by broker type. The attribute must support consistent classification in Microsoft Entra. The answer must not overload the display name field. What should you do first?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationDefine the attribute set and allowed values

Custom security attributes provide structured classification data for supported scenarios.

Device join and registration

Blink Inc is tightening access from managed and personal devices. The team must understand device identity state before writing access policy. The answer must distinguish joined and registered devices. What should you do first?

Identify which device state the business requires for accessUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Device state can be an access signal, but device registration is not the same as compliance.

External users

Whippet Exports invites customs brokers to collaborate. The company must control guest access without creating employee accounts. The answer must support partner lifecycle management. What should you do first?

Disable audit logs before migrationReview external collaboration settings and invitation permissionsCreate all partner users as employeesUse terms of use as the sync engine

External collaboration settings and guest users are central to partner access scenarios.

Cross tenant access

Whippet Exports works with a partner that has its own Microsoft Entra tenant. Inbound collaboration must be controlled for that partner tenant. The answer must distinguish inbound and outbound access. What should you do first?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityIdentify whether the requirement is inbound or outboundMake every helpdesk user Privileged Role Administrator

Cross tenant access settings control collaboration between Microsoft Entra tenants.

Hybrid identity

Mill Town Engineering synchronises AD DS users to Microsoft Entra ID. The team must choose the right synchronisation and authentication design. The answer must account for existing on premises identity. What should you do first?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationDocument sync requirements, authentication needs, and unsupported features

Hybrid identity questions often test sync engine choice, authentication method, and health monitoring.

Tenant settings

Liver Shipping is standardising its Microsoft Entra tenant. The team must review settings that affect users, groups, devices, roles, domains, and branding. The answer must cover tenant level configuration. Which source should you use to confirm the result?

Audit logs and tenant settings in the Microsoft Entra admin centreUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Tenant configuration covers several settings. The exam may hide the answer behind a mix of domains, users, groups, devices, and roles.

Administrative units

Liver Shipping has helpdesk teams in separate port offices. The Belfast helpdesk must reset passwords only for Belfast users. The team must not manage users in other ports. Which source should you use to confirm the result?

Disable audit logs before migrationRole assignment details and audit logsCreate all partner users as employeesUse terms of use as the sync engine

Administrative units scope supported role assignments to a subset of directory objects.

Microsoft Entra roles

Blink Inc is delegating application administration. A user must create and manage enterprise applications but must not manage all tenant settings. The answer must follow least privilege. Which source should you use to confirm the result?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityRole assignment details and audit logsMake every helpdesk user Privileged Role Administrator

Built in roles are preferred when they meet the task. Global Administrator is usually too broad.

Users and bulk operations

Mill Town Engineering is onboarding 200 contractors. The identity team must create users efficiently and consistently. Manual one by one creation should be avoided. Which source should you use to confirm the result?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationAudit logs and user creation results

Bulk operations and PowerShell reduce manual errors when many identities must be created or updated.

Groups and licences

Blink Inc assigns Microsoft 365 licences by department. Licences must follow group membership and show assignment errors. The answer must not rely on manual licence assignment for every user. Which source should you use to confirm the result?

Licence assignment status and group membershipUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Group based licensing is used when membership should drive licence assignment.

Custom security attributes

Whippet Exports classifies partner users by broker type. The attribute must support consistent classification in Microsoft Entra. The answer must not overload the display name field. Which source should you use to confirm the result?

Disable audit logs before migrationUser attribute values and audit logsCreate all partner users as employeesUse terms of use as the sync engine

Custom security attributes provide structured classification data for supported scenarios.

Device join and registration

Blink Inc is tightening access from managed and personal devices. The team must understand device identity state before writing access policy. The answer must distinguish joined and registered devices. Which source should you use to confirm the result?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityDevice records and sign in logsMake every helpdesk user Privileged Role Administrator

Device state can be an access signal, but device registration is not the same as compliance.

External users

Whippet Exports invites customs brokers to collaborate. The company must control guest access without creating employee accounts. The answer must support partner lifecycle management. Which source should you use to confirm the result?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationGuest user properties and audit logs

External collaboration settings and guest users are central to partner access scenarios.

Cross tenant access

Whippet Exports works with a partner that has its own Microsoft Entra tenant. Inbound collaboration must be controlled for that partner tenant. The answer must distinguish inbound and outbound access. Which source should you use to confirm the result?

Cross tenant access settings and sign in logsUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Cross tenant access settings control collaboration between Microsoft Entra tenants.

Hybrid identity

Mill Town Engineering synchronises AD DS users to Microsoft Entra ID. The team must choose the right synchronisation and authentication design. The answer must account for existing on premises identity. Which source should you use to confirm the result?

Disable audit logs before migrationMicrosoft Entra Connect Health and sync statusCreate all partner users as employeesUse terms of use as the sync engine

Hybrid identity questions often test sync engine choice, authentication method, and health monitoring.

Tenant settings

Liver Shipping is standardising its Microsoft Entra tenant. The team must review settings that affect users, groups, devices, roles, domains, and branding. The answer must cover tenant level configuration. Which option meets the requirement with the least privilege?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityAssign only the role needed to change the relevant tenant settingMake every helpdesk user Privileged Role Administrator

Tenant configuration covers several settings. The exam may hide the answer behind a mix of domains, users, groups, devices, and roles.

Administrative units

Liver Shipping has helpdesk teams in separate port offices. The Belfast helpdesk must reset passwords only for Belfast users. The team must not manage users in other ports. Which option meets the requirement with the least privilege?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationUse a scoped role assignment instead of tenant wide User Administrator

Administrative units scope supported role assignments to a subset of directory objects.

Microsoft Entra roles

Blink Inc is delegating application administration. A user must create and manage enterprise applications but must not manage all tenant settings. The answer must follow least privilege. Which option meets the requirement with the least privilege?

Use the narrowest application administration role that meets the taskUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Built in roles are preferred when they meet the task. Global Administrator is usually too broad.

Users and bulk operations

Mill Town Engineering is onboarding 200 contractors. The identity team must create users efficiently and consistently. Manual one by one creation should be avoided. Which option meets the requirement with the least privilege?

Disable audit logs before migrationGrant the operator only the user management role required for onboardingCreate all partner users as employeesUse terms of use as the sync engine

Bulk operations and PowerShell reduce manual errors when many identities must be created or updated.

Groups and licences

Blink Inc assigns Microsoft 365 licences by department. Licences must follow group membership and show assignment errors. The answer must not rely on manual licence assignment for every user. Which option meets the requirement with the least privilege?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityUse group based licensing instead of assigning each licence manuallyMake every helpdesk user Privileged Role Administrator

Group based licensing is used when membership should drive licence assignment.

Custom security attributes

Whippet Exports classifies partner users by broker type. The attribute must support consistent classification in Microsoft Entra. The answer must not overload the display name field. Which option meets the requirement with the least privilege?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationDelegate attribute management only to users who need it

Custom security attributes provide structured classification data for supported scenarios.

Device join and registration

Blink Inc is tightening access from managed and personal devices. The team must understand device identity state before writing access policy. The answer must distinguish joined and registered devices. Which option meets the requirement with the least privilege?

Use device state signals rather than giving users extra directory rolesUse a shared guest accountUse Conditional Access to assign licencesUse app roles to join devices

Device state can be an access signal, but device registration is not the same as compliance.

External users

Whippet Exports invites customs brokers to collaborate. The company must control guest access without creating employee accounts. The answer must support partner lifecycle management. Which option meets the requirement with the least privilege?

Disable audit logs before migrationUse guest accounts and lifecycle controls instead of shared accountsCreate all partner users as employeesUse terms of use as the sync engine

External collaboration settings and guest users are central to partner access scenarios.

Cross tenant access

Whippet Exports works with a partner that has its own Microsoft Entra tenant. Inbound collaboration must be controlled for that partner tenant. The answer must distinguish inbound and outbound access. Which option meets the requirement with the least privilege?

Use Defender for Cloud Apps as the group ruleUse a storage account key as the user identityApply partner specific settings instead of relaxing defaults for everyoneMake every helpdesk user Privileged Role Administrator

Cross tenant access settings control collaboration between Microsoft Entra tenants.

Hybrid identity

Mill Town Engineering synchronises AD DS users to Microsoft Entra ID. The team must choose the right synchronisation and authentication design. The answer must account for existing on premises identity. Which option meets the requirement with the least privilege?

Assign Global Administrator at tenant scopeCreate a new verified domain for each departmentUse company branding to delegate administrationChoose the simplest supported sync option that meets the requirements

Hybrid identity questions often test sync engine choice, authentication method, and health monitoring.

Tenant settings

Liver Shipping is standardising its Microsoft Entra tenant. The team must review settings that affect users, groups, devices, roles, domains, and branding. The answer must cover tenant level configuration. Which two choices should be included?

Review tenant properties, user settings, group settings, device settings, domains, roles, and company brandingUse a shared guest accountAudit logs and tenant settings in the Microsoft Entra admin centreUse Conditional Access to assign licences

Tenant configuration covers several settings. The exam may hide the answer behind a mix of domains, users, groups, devices, and roles.

Administrative units

Liver Shipping has helpdesk teams in separate port offices. The Belfast helpdesk must reset passwords only for Belfast users. The team must not manage users in other ports. Which two choices should be included?

Create an administrative unit for Belfast users and assign a supported scoped roleDisable audit logs before migrationRole assignment details and audit logsCreate all partner users as employees

Administrative units scope supported role assignments to a subset of directory objects.

Microsoft Entra roles

Blink Inc is delegating application administration. A user must create and manage enterprise applications but must not manage all tenant settings. The answer must follow least privilege. Which two choices should be included?

Assign an application focused Microsoft Entra role that matches the required tasksUse Defender for Cloud Apps as the group ruleRole assignment details and audit logsUse a storage account key as the user identity

Built in roles are preferred when they meet the task. Global Administrator is usually too broad.

Users and bulk operations

Mill Town Engineering is onboarding 200 contractors. The identity team must create users efficiently and consistently. Manual one by one creation should be avoided. Which two choices should be included?

Use bulk user operations or PowerShell for repeatable account creationAssign Global Administrator at tenant scopeAudit logs and user creation resultsCreate a new verified domain for each department

Bulk operations and PowerShell reduce manual errors when many identities must be created or updated.

Groups and licences

Blink Inc assigns Microsoft 365 licences by department. Licences must follow group membership and show assignment errors. The answer must not rely on manual licence assignment for every user. Which two choices should be included?

Use group based licensing and monitor assignment errorsUse a shared guest accountLicence assignment status and group membershipUse Conditional Access to assign licences

Group based licensing is used when membership should drive licence assignment.

Custom security attributes

Whippet Exports classifies partner users by broker type. The attribute must support consistent classification in Microsoft Entra. The answer must not overload the display name field. Which two choices should be included?

Use custom security attributes for the classification where supportedDisable audit logs before migrationUser attribute values and audit logsCreate all partner users as employees

Custom security attributes provide structured classification data for supported scenarios.

Device join and registration

Blink Inc is tightening access from managed and personal devices. The team must understand device identity state before writing access policy. The answer must distinguish joined and registered devices. Which two choices should be included?

Review Microsoft Entra joined, registered, and hybrid joined device statesUse Defender for Cloud Apps as the group ruleDevice records and sign in logsUse a storage account key as the user identity

Device state can be an access signal, but device registration is not the same as compliance.

External users

Whippet Exports invites customs brokers to collaborate. The company must control guest access without creating employee accounts. The answer must support partner lifecycle management. Which two choices should be included?

Use guest users with external collaboration controlsAssign Global Administrator at tenant scopeGuest user properties and audit logsCreate a new verified domain for each department

External collaboration settings and guest users are central to partner access scenarios.

Cross tenant access

Whippet Exports works with a partner that has its own Microsoft Entra tenant. Inbound collaboration must be controlled for that partner tenant. The answer must distinguish inbound and outbound access. Which two choices should be included?

Configure organisation specific cross tenant access settingsUse a shared guest accountCross tenant access settings and sign in logsUse Conditional Access to assign licences

Cross tenant access settings control collaboration between Microsoft Entra tenants.

Hybrid identity

Mill Town Engineering synchronises AD DS users to Microsoft Entra ID. The team must choose the right synchronisation and authentication design. The answer must account for existing on premises identity. Which two choices should be included?

Evaluate Microsoft Entra Connect Sync, Cloud Sync, password hash synchronisation, pass through authentication, and seamless SSODisable audit logs before migrationMicrosoft Entra Connect Health and sync statusCreate all partner users as employees

Hybrid identity questions often test sync engine choice, authentication method, and health monitoring.

Implement an authentication and access management solution50 questions

Learning Path | 4 hr 58 min

MFA, authentication methods, SSPR, Conditional Access, Identity Protection, and Global Secure Access.

Authentication methods

Blink Inc is moving users to stronger authentication. The team must control which methods users can register. The answer must not rely on legacy per user MFA alone. What should you recommend?

Configure the authentication methods policyDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Authentication methods policy controls available sign in methods such as Authenticator, passkeys, and certificate based authentication.

Temporary Access Pass

Blink Inc is onboarding a new starter. The user must register passwordless authentication without a long term password. The answer must be time limited. What should you recommend?

Disable sign in logsCreate a Temporary Access Pass for the userUse terms of use as a network clientStore passkeys in a shared mailbox

Temporary Access Pass is designed for secure onboarding and recovery.

MFA and registration

Liver Shipping is enforcing MFA for staff. Users must be prepared before enforcement begins. The rollout should reduce avoidable support calls. What should you recommend?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsUse registration campaigns and authentication method reportingExclude every user from the policy

Registration readiness matters before MFA enforcement.

SSPR

Blink Inc wants users to reset passwords without calling support. Users must be registered for the required methods. The answer must support self service recovery. What should you recommend?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassConfigure self service password reset and registration requirements

SSPR depends on configuration and user registration.

Session revocation

Mill Town Engineering suspects a user account is compromised. The team has disabled the account but wants to stop existing sessions. The answer must address active sessions. What should you recommend?

Revoke the user's sessionsDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Disabling an account stops new sign ins, but existing sessions may need revocation.

Conditional Access assignments

Liver Shipping is creating a policy for finance apps. The policy must apply to finance users and the finance application only. Emergency access accounts must be excluded. What should you recommend?

Disable sign in logsConfigure Conditional Access assignments for the target users, app, and exclusionsUse terms of use as a network clientStore passkeys in a shared mailbox

Assignments define who and what a Conditional Access policy applies to.

Conditional Access testing

Blink Inc is deploying a new block policy. The team must confirm the effect before users are blocked. The answer must avoid immediate disruption. What should you recommend?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsEnable the policy in report only mode firstExclude every user from the policy

Report only mode shows expected Conditional Access results without enforcing the policy.

Identity Protection

Whippet Exports is responding to risky sign ins. High sign in risk should trigger stronger controls. The answer must use risk signals. What should you recommend?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassCreate a risk based Conditional Access policy

Microsoft Entra ID Protection supports user risk and sign in risk based decisions.

Global Secure Access

Mill Town Engineering is protecting private engineering applications. Remote users need identity based access to private apps. The answer must include the required client and traffic profile. What should you recommend?

Deploy Global Secure Access with Private Access for the private applicationsDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Global Secure Access Private Access is used for identity centred access to private applications.

Password protection

Liver Shipping wants to reduce weak password use. The policy must block known weak terms and company specific words. The answer must work with Microsoft Entra password controls. What should you recommend?

Disable sign in logsConfigure Microsoft Entra password protection with custom banned passwordsUse terms of use as a network clientStore passkeys in a shared mailbox

Microsoft Entra password protection helps block weak and banned passwords.

Authentication methods

Blink Inc is moving users to stronger authentication. The team must control which methods users can register. The answer must not rely on legacy per user MFA alone. What should you do first?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsReview current method registration and target groupsExclude every user from the policy

Authentication methods policy controls available sign in methods such as Authenticator, passkeys, and certificate based authentication.

Temporary Access Pass

Blink Inc is onboarding a new starter. The user must register passwordless authentication without a long term password. The answer must be time limited. What should you do first?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassConfirm the user has no usable strong authentication method yet

Temporary Access Pass is designed for secure onboarding and recovery.

MFA and registration

Liver Shipping is enforcing MFA for staff. Users must be prepared before enforcement begins. The rollout should reduce avoidable support calls. What should you do first?

Measure registration status before enforcementDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Registration readiness matters before MFA enforcement.

SSPR

Blink Inc wants users to reset passwords without calling support. Users must be registered for the required methods. The answer must support self service recovery. What should you do first?

Disable sign in logsConfirm the target group and authentication methodsUse terms of use as a network clientStore passkeys in a shared mailbox

SSPR depends on configuration and user registration.

Session revocation

Mill Town Engineering suspects a user account is compromised. The team has disabled the account but wants to stop existing sessions. The answer must address active sessions. What should you do first?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsDisable the account and identify active sign in activityExclude every user from the policy

Disabling an account stops new sign ins, but existing sessions may need revocation.

Conditional Access assignments

Liver Shipping is creating a policy for finance apps. The policy must apply to finance users and the finance application only. Emergency access accounts must be excluded. What should you do first?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassIdentify users, groups, cloud apps, and exclusions

Assignments define who and what a Conditional Access policy applies to.

Conditional Access testing

Blink Inc is deploying a new block policy. The team must confirm the effect before users are blocked. The answer must avoid immediate disruption. What should you do first?

Define the policy scope and exclusionsDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Report only mode shows expected Conditional Access results without enforcing the policy.

Identity Protection

Whippet Exports is responding to risky sign ins. High sign in risk should trigger stronger controls. The answer must use risk signals. What should you do first?

Disable sign in logsConfirm risk levels and target usersUse terms of use as a network clientStore passkeys in a shared mailbox

Microsoft Entra ID Protection supports user risk and sign in risk based decisions.

Global Secure Access

Mill Town Engineering is protecting private engineering applications. Remote users need identity based access to private apps. The answer must include the required client and traffic profile. What should you do first?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsIdentify the private app traffic and client deployment scopeExclude every user from the policy

Global Secure Access Private Access is used for identity centred access to private applications.

Password protection

Liver Shipping wants to reduce weak password use. The policy must block known weak terms and company specific words. The answer must work with Microsoft Entra password controls. What should you do first?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassIdentify the company specific banned terms

Microsoft Entra password protection helps block weak and banned passwords.

Authentication methods

Blink Inc is moving users to stronger authentication. The team must control which methods users can register. The answer must not rely on legacy per user MFA alone. Which source should you use to confirm the result?

Authentication method registration and usage reportsDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Authentication methods policy controls available sign in methods such as Authenticator, passkeys, and certificate based authentication.

Temporary Access Pass

Blink Inc is onboarding a new starter. The user must register passwordless authentication without a long term password. The answer must be time limited. Which source should you use to confirm the result?

Disable sign in logsAuthentication method details and audit logsUse terms of use as a network clientStore passkeys in a shared mailbox

Temporary Access Pass is designed for secure onboarding and recovery.

MFA and registration

Liver Shipping is enforcing MFA for staff. Users must be prepared before enforcement begins. The rollout should reduce avoidable support calls. Which source should you use to confirm the result?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsAuthentication method registration reportsExclude every user from the policy

Registration readiness matters before MFA enforcement.

SSPR

Blink Inc wants users to reset passwords without calling support. Users must be registered for the required methods. The answer must support self service recovery. Which source should you use to confirm the result?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassSSPR registration and audit logs

SSPR depends on configuration and user registration.

Session revocation

Mill Town Engineering suspects a user account is compromised. The team has disabled the account but wants to stop existing sessions. The answer must address active sessions. Which source should you use to confirm the result?

Sign in logs and user session detailsDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Disabling an account stops new sign ins, but existing sessions may need revocation.

Conditional Access assignments

Liver Shipping is creating a policy for finance apps. The policy must apply to finance users and the finance application only. Emergency access accounts must be excluded. Which source should you use to confirm the result?

Disable sign in logsConditional Access policy details and sign in logsUse terms of use as a network clientStore passkeys in a shared mailbox

Assignments define who and what a Conditional Access policy applies to.

Conditional Access testing

Blink Inc is deploying a new block policy. The team must confirm the effect before users are blocked. The answer must avoid immediate disruption. Which source should you use to confirm the result?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsSign in logs with report only policy resultsExclude every user from the policy

Report only mode shows expected Conditional Access results without enforcing the policy.

Identity Protection

Whippet Exports is responding to risky sign ins. High sign in risk should trigger stronger controls. The answer must use risk signals. Which source should you use to confirm the result?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassRisky sign ins and sign in logs

Microsoft Entra ID Protection supports user risk and sign in risk based decisions.

Global Secure Access

Mill Town Engineering is protecting private engineering applications. Remote users need identity based access to private apps. The answer must include the required client and traffic profile. Which source should you use to confirm the result?

Global Secure Access traffic and sign in evidenceDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Global Secure Access Private Access is used for identity centred access to private applications.

Password protection

Liver Shipping wants to reduce weak password use. The policy must block known weak terms and company specific words. The answer must work with Microsoft Entra password controls. Which source should you use to confirm the result?

Disable sign in logsPassword protection settings and audit eventsUse terms of use as a network clientStore passkeys in a shared mailbox

Microsoft Entra password protection helps block weak and banned passwords.

Authentication methods

Blink Inc is moving users to stronger authentication. The team must control which methods users can register. The answer must not rely on legacy per user MFA alone. Which option meets the requirement with the least privilege?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsEnable only the required methods for the target usersExclude every user from the policy

Authentication methods policy controls available sign in methods such as Authenticator, passkeys, and certificate based authentication.

Temporary Access Pass

Blink Inc is onboarding a new starter. The user must register passwordless authentication without a long term password. The answer must be time limited. Which option meets the requirement with the least privilege?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassUse a time limited TAP instead of a shared password

Temporary Access Pass is designed for secure onboarding and recovery.

MFA and registration

Liver Shipping is enforcing MFA for staff. Users must be prepared before enforcement begins. The rollout should reduce avoidable support calls. Which option meets the requirement with the least privilege?

Target only the required users and methods firstDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Registration readiness matters before MFA enforcement.

SSPR

Blink Inc wants users to reset passwords without calling support. Users must be registered for the required methods. The answer must support self service recovery. Which option meets the requirement with the least privilege?

Disable sign in logsEnable SSPR for the required group instead of all tenant admins onlyUse terms of use as a network clientStore passkeys in a shared mailbox

SSPR depends on configuration and user registration.

Session revocation

Mill Town Engineering suspects a user account is compromised. The team has disabled the account but wants to stop existing sessions. The answer must address active sessions. Which option meets the requirement with the least privilege?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsRevoke sessions for the affected user rather than changing unrelated tenant settingsExclude every user from the policy

Disabling an account stops new sign ins, but existing sessions may need revocation.

Conditional Access assignments

Liver Shipping is creating a policy for finance apps. The policy must apply to finance users and the finance application only. Emergency access accounts must be excluded. Which option meets the requirement with the least privilege?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassScope the policy to the required users and app

Assignments define who and what a Conditional Access policy applies to.

Conditional Access testing

Blink Inc is deploying a new block policy. The team must confirm the effect before users are blocked. The answer must avoid immediate disruption. Which option meets the requirement with the least privilege?

Test with report only mode before enforcementDelete all authentication methodsUse a custom domain to revoke sessionsUse app collections to register MFA

Report only mode shows expected Conditional Access results without enforcing the policy.

Identity Protection

Whippet Exports is responding to risky sign ins. High sign in risk should trigger stronger controls. The answer must use risk signals. Which option meets the requirement with the least privilege?

Disable sign in logsTarget the risk based control to affected users and appsUse terms of use as a network clientStore passkeys in a shared mailbox

Microsoft Entra ID Protection supports user risk and sign in risk based decisions.

Global Secure Access

Mill Town Engineering is protecting private engineering applications. Remote users need identity based access to private apps. The answer must include the required client and traffic profile. Which option meets the requirement with the least privilege?

Use licence assignment as the risk controlUse audit logs alone for Conditional Access resultsUse Private Access for private apps rather than broad network accessExclude every user from the policy

Global Secure Access Private Access is used for identity centred access to private applications.

Password protection

Liver Shipping wants to reduce weak password use. The policy must block known weak terms and company specific words. The answer must work with Microsoft Entra password controls. Which option meets the requirement with the least privilege?

Enable the policy for all users without exclusionsUse company branding as an MFA methodCreate one shared Temporary Access PassUse password protection rather than manual password review

Microsoft Entra password protection helps block weak and banned passwords.

Authentication methods

Blink Inc is moving users to stronger authentication. The team must control which methods users can register. The answer must not rely on legacy per user MFA alone. Which two choices should be included?

Configure the authentication methods policyDelete all authentication methodsAuthentication method registration and usage reportsUse a custom domain to revoke sessions

Authentication methods policy controls available sign in methods such as Authenticator, passkeys, and certificate based authentication.

Temporary Access Pass

Blink Inc is onboarding a new starter. The user must register passwordless authentication without a long term password. The answer must be time limited. Which two choices should be included?

Create a Temporary Access Pass for the userDisable sign in logsAuthentication method details and audit logsUse terms of use as a network client

Temporary Access Pass is designed for secure onboarding and recovery.

MFA and registration

Liver Shipping is enforcing MFA for staff. Users must be prepared before enforcement begins. The rollout should reduce avoidable support calls. Which two choices should be included?

Use registration campaigns and authentication method reportingUse licence assignment as the risk controlAuthentication method registration reportsUse audit logs alone for Conditional Access results

Registration readiness matters before MFA enforcement.

SSPR

Blink Inc wants users to reset passwords without calling support. Users must be registered for the required methods. The answer must support self service recovery. Which two choices should be included?

Configure self service password reset and registration requirementsEnable the policy for all users without exclusionsSSPR registration and audit logsUse company branding as an MFA method

SSPR depends on configuration and user registration.

Session revocation

Mill Town Engineering suspects a user account is compromised. The team has disabled the account but wants to stop existing sessions. The answer must address active sessions. Which two choices should be included?

Revoke the user's sessionsDelete all authentication methodsSign in logs and user session detailsUse a custom domain to revoke sessions

Disabling an account stops new sign ins, but existing sessions may need revocation.

Conditional Access assignments

Liver Shipping is creating a policy for finance apps. The policy must apply to finance users and the finance application only. Emergency access accounts must be excluded. Which two choices should be included?

Configure Conditional Access assignments for the target users, app, and exclusionsDisable sign in logsConditional Access policy details and sign in logsUse terms of use as a network client

Assignments define who and what a Conditional Access policy applies to.

Conditional Access testing

Blink Inc is deploying a new block policy. The team must confirm the effect before users are blocked. The answer must avoid immediate disruption. Which two choices should be included?

Enable the policy in report only mode firstUse licence assignment as the risk controlSign in logs with report only policy resultsUse audit logs alone for Conditional Access results

Report only mode shows expected Conditional Access results without enforcing the policy.

Identity Protection

Whippet Exports is responding to risky sign ins. High sign in risk should trigger stronger controls. The answer must use risk signals. Which two choices should be included?

Create a risk based Conditional Access policyEnable the policy for all users without exclusionsRisky sign ins and sign in logsUse company branding as an MFA method

Microsoft Entra ID Protection supports user risk and sign in risk based decisions.

Global Secure Access

Mill Town Engineering is protecting private engineering applications. Remote users need identity based access to private apps. The answer must include the required client and traffic profile. Which two choices should be included?

Deploy Global Secure Access with Private Access for the private applicationsDelete all authentication methodsGlobal Secure Access traffic and sign in evidenceUse a custom domain to revoke sessions

Global Secure Access Private Access is used for identity centred access to private applications.

Password protection

Liver Shipping wants to reduce weak password use. The policy must block known weak terms and company specific words. The answer must work with Microsoft Entra password controls. Which two choices should be included?

Configure Microsoft Entra password protection with custom banned passwordsDisable sign in logsPassword protection settings and audit eventsUse terms of use as a network client

Microsoft Entra password protection helps block weak and banned passwords.

Implement access management for apps50 questions

Learning Path | 2 hr 34 min

Enterprise applications, SSO, Application Proxy, app registrations, API permissions, consent, and Defender for Cloud Apps.

Managed identities

Mill Town Engineering has an Azure automation process. The process must access Key Vault without a secret in code. The resource supports managed identities. What should you recommend?

Enable a managed identity and grant it access to Key VaultUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Managed identities avoid storing application secrets for supported Azure resources.

Service principals

Blink Inc has a daemon application outside Azure. The app must authenticate without a signed in user. Managed identity is not available for this workload. What should you recommend?

Use sign in logs as client credentialsUse an app registration and service principal with application permissionsDisable consent reviewUse device join settings as SSO

Service principals represent application identities when managed identity is not available.

Enterprise application SSO

Liver Shipping is adding a SaaS application. Only selected users should access the app through Microsoft Entra SSO. The answer must control assignment. What should you recommend?

Create a shared user account for the applicationUse a custom domain as the app roleConfigure the enterprise application SSO and assign users or groupsReplace app registration with group based licensing

Enterprise applications handle SSO, assignment, and app specific access for many SaaS apps.

Application Proxy

Whippet Exports has an internal web app. Remote users need access without exposing the internal network broadly. The app remains on premises. What should you recommend?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestPublish the app with Microsoft Entra Application Proxy

Application Proxy publishes supported on premises web apps through Microsoft Entra.

User provisioning

Blink Inc wants SaaS app accounts to match Microsoft Entra assignments. User creation and removal should be automated. The SaaS app supports provisioning. What should you recommend?

Configure automatic user provisioning for the enterprise applicationUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Provisioning logs show account creation, update, and removal activity in target apps.

Admin consent

Mill Town Engineering reviews a third party app request. The app requests high privilege Microsoft Graph application permissions. Consent must be controlled. What should you recommend?

Use sign in logs as client credentialsUse an admin consent review or workflow before granting tenant wide consentDisable consent reviewUse device join settings as SSO

Admin consent should be controlled for high impact permissions.

App registration authentication

Blink Inc is registering a web application. The app must sign users in securely. The answer must include correct platform settings. What should you recommend?

Create a shared user account for the applicationUse a custom domain as the app roleConfigure redirect URIs and authentication settings for the app registrationReplace app registration with group based licensing

App registration authentication settings must match the application platform and flow.

API permissions

Blink Inc is building an API client. The app must call Microsoft Graph without a signed in user. The answer must not use delegated permissions. What should you recommend?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestConfigure the required application permissions and grant admin consent

Application permissions are used when the app acts without a signed in user.

Defender for Cloud Apps

Mill Town Engineering wants to control risky cloud app sessions. The control must inspect activity during a session. The answer must integrate with Conditional Access where required. What should you recommend?

Configure Conditional Access app control with Defender for Cloud AppsUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Conditional Access app control can route sessions through Defender for Cloud Apps.

OAuth app governance

Whippet Exports is reviewing risky OAuth apps. The team must identify and control apps granted access by users. The answer must focus on OAuth app risk. What should you recommend?

Use sign in logs as client credentialsUse Defender for Cloud Apps policies for OAuth appsDisable consent reviewUse device join settings as SSO

OAuth app policies help govern risky app consent and access.

Managed identities

Mill Town Engineering has an Azure automation process. The process must access Key Vault without a secret in code. The resource supports managed identities. What should you do first?

Create a shared user account for the applicationUse a custom domain as the app roleConfirm whether a system assigned or user assigned identity fits the designReplace app registration with group based licensing

Managed identities avoid storing application secrets for supported Azure resources.

Service principals

Blink Inc has a daemon application outside Azure. The app must authenticate without a signed in user. Managed identity is not available for this workload. What should you do first?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestConfirm the workload cannot use managed identity

Service principals represent application identities when managed identity is not available.

Enterprise application SSO

Liver Shipping is adding a SaaS application. Only selected users should access the app through Microsoft Entra SSO. The answer must control assignment. What should you do first?

Add or locate the enterprise applicationUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Enterprise applications handle SSO, assignment, and app specific access for many SaaS apps.

Application Proxy

Whippet Exports has an internal web app. Remote users need access without exposing the internal network broadly. The app remains on premises. What should you do first?

Use sign in logs as client credentialsInstall and register an Application Proxy connectorDisable consent reviewUse device join settings as SSO

Application Proxy publishes supported on premises web apps through Microsoft Entra.

User provisioning

Blink Inc wants SaaS app accounts to match Microsoft Entra assignments. User creation and removal should be automated. The SaaS app supports provisioning. What should you do first?

Create a shared user account for the applicationUse a custom domain as the app roleConfirm the app supports provisioning and map attributesReplace app registration with group based licensing

Provisioning logs show account creation, update, and removal activity in target apps.

Admin consent

Mill Town Engineering reviews a third party app request. The app requests high privilege Microsoft Graph application permissions. Consent must be controlled. What should you do first?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestReview the requested API permissions and publisher details

Admin consent should be controlled for high impact permissions.

App registration authentication

Blink Inc is registering a web application. The app must sign users in securely. The answer must include correct platform settings. What should you do first?

Identify the application platform and sign in flowUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

App registration authentication settings must match the application platform and flow.

API permissions

Blink Inc is building an API client. The app must call Microsoft Graph without a signed in user. The answer must not use delegated permissions. What should you do first?

Use sign in logs as client credentialsIdentify whether the app acts with or without a signed in userDisable consent reviewUse device join settings as SSO

Application permissions are used when the app acts without a signed in user.

Defender for Cloud Apps

Mill Town Engineering wants to control risky cloud app sessions. The control must inspect activity during a session. The answer must integrate with Conditional Access where required. What should you do first?

Create a shared user account for the applicationUse a custom domain as the app roleConnect the app and define the session control requirementReplace app registration with group based licensing

Conditional Access app control can route sessions through Defender for Cloud Apps.

OAuth app governance

Whippet Exports is reviewing risky OAuth apps. The team must identify and control apps granted access by users. The answer must focus on OAuth app risk. What should you do first?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestReview discovered OAuth apps and permissions

OAuth app policies help govern risky app consent and access.

Managed identities

Mill Town Engineering has an Azure automation process. The process must access Key Vault without a secret in code. The resource supports managed identities. Which source should you use to confirm the result?

Managed identity settings and Key Vault access logsUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Managed identities avoid storing application secrets for supported Azure resources.

Service principals

Blink Inc has a daemon application outside Azure. The app must authenticate without a signed in user. Managed identity is not available for this workload. Which source should you use to confirm the result?

Use sign in logs as client credentialsApp registration, service principal, and sign in logsDisable consent reviewUse device join settings as SSO

Service principals represent application identities when managed identity is not available.

Enterprise application SSO

Liver Shipping is adding a SaaS application. Only selected users should access the app through Microsoft Entra SSO. The answer must control assignment. Which source should you use to confirm the result?

Create a shared user account for the applicationUse a custom domain as the app roleEnterprise application sign in logs and assignment detailsReplace app registration with group based licensing

Enterprise applications handle SSO, assignment, and app specific access for many SaaS apps.

Application Proxy

Whippet Exports has an internal web app. Remote users need access without exposing the internal network broadly. The app remains on premises. Which source should you use to confirm the result?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestApplication Proxy connector health and sign in logs

Application Proxy publishes supported on premises web apps through Microsoft Entra.

User provisioning

Blink Inc wants SaaS app accounts to match Microsoft Entra assignments. User creation and removal should be automated. The SaaS app supports provisioning. Which source should you use to confirm the result?

Provisioning logsUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Provisioning logs show account creation, update, and removal activity in target apps.

Admin consent

Mill Town Engineering reviews a third party app request. The app requests high privilege Microsoft Graph application permissions. Consent must be controlled. Which source should you use to confirm the result?

Use sign in logs as client credentialsAudit logs and app consent recordsDisable consent reviewUse device join settings as SSO

Admin consent should be controlled for high impact permissions.

App registration authentication

Blink Inc is registering a web application. The app must sign users in securely. The answer must include correct platform settings. Which source should you use to confirm the result?

Create a shared user account for the applicationUse a custom domain as the app roleApp registration settings and sign in logsReplace app registration with group based licensing

App registration authentication settings must match the application platform and flow.

API permissions

Blink Inc is building an API client. The app must call Microsoft Graph without a signed in user. The answer must not use delegated permissions. Which source should you use to confirm the result?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestAPI permissions and consent records

Application permissions are used when the app acts without a signed in user.

Defender for Cloud Apps

Mill Town Engineering wants to control risky cloud app sessions. The control must inspect activity during a session. The answer must integrate with Conditional Access where required. Which source should you use to confirm the result?

Defender for Cloud Apps policy logsUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Conditional Access app control can route sessions through Defender for Cloud Apps.

OAuth app governance

Whippet Exports is reviewing risky OAuth apps. The team must identify and control apps granted access by users. The answer must focus on OAuth app risk. Which source should you use to confirm the result?

Use sign in logs as client credentialsOAuth app governance and Defender for Cloud Apps alertsDisable consent reviewUse device join settings as SSO

OAuth app policies help govern risky app consent and access.

Managed identities

Mill Town Engineering has an Azure automation process. The process must access Key Vault without a secret in code. The resource supports managed identities. Which option meets the requirement with the least privilege?

Create a shared user account for the applicationUse a custom domain as the app roleGrant the managed identity only the Key Vault permissions it needsReplace app registration with group based licensing

Managed identities avoid storing application secrets for supported Azure resources.

Service principals

Blink Inc has a daemon application outside Azure. The app must authenticate without a signed in user. Managed identity is not available for this workload. Which option meets the requirement with the least privilege?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestGrant only the required application permissions

Service principals represent application identities when managed identity is not available.

Enterprise application SSO

Liver Shipping is adding a SaaS application. Only selected users should access the app through Microsoft Entra SSO. The answer must control assignment. Which option meets the requirement with the least privilege?

Assign only the required groups to the applicationUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

Enterprise applications handle SSO, assignment, and app specific access for many SaaS apps.

Application Proxy

Whippet Exports has an internal web app. Remote users need access without exposing the internal network broadly. The app remains on premises. Which option meets the requirement with the least privilege?

Use sign in logs as client credentialsPublish only the required applicationDisable consent reviewUse device join settings as SSO

Application Proxy publishes supported on premises web apps through Microsoft Entra.

User provisioning

Blink Inc wants SaaS app accounts to match Microsoft Entra assignments. User creation and removal should be automated. The SaaS app supports provisioning. Which option meets the requirement with the least privilege?

Create a shared user account for the applicationUse a custom domain as the app roleProvision only assigned users and groupsReplace app registration with group based licensing

Provisioning logs show account creation, update, and removal activity in target apps.

Admin consent

Mill Town Engineering reviews a third party app request. The app requests high privilege Microsoft Graph application permissions. Consent must be controlled. Which option meets the requirement with the least privilege?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestGrant only justified permissions after review

Admin consent should be controlled for high impact permissions.

App registration authentication

Blink Inc is registering a web application. The app must sign users in securely. The answer must include correct platform settings. Which option meets the requirement with the least privilege?

Configure only the required redirect URIsUse password hash synchronisation to publish the appAssign every user Application AdministratorUse access packages as API permissions

App registration authentication settings must match the application platform and flow.

API permissions

Blink Inc is building an API client. The app must call Microsoft Graph without a signed in user. The answer must not use delegated permissions. Which option meets the requirement with the least privilege?

Use sign in logs as client credentialsGrant only the required application permissionsDisable consent reviewUse device join settings as SSO

Application permissions are used when the app acts without a signed in user.

Defender for Cloud Apps

Mill Town Engineering wants to control risky cloud app sessions. The control must inspect activity during a session. The answer must integrate with Conditional Access where required. Which option meets the requirement with the least privilege?

Create a shared user account for the applicationUse a custom domain as the app roleUse session policy controls for the target app onlyReplace app registration with group based licensing

Conditional Access app control can route sessions through Defender for Cloud Apps.

OAuth app governance

Whippet Exports is reviewing risky OAuth apps. The team must identify and control apps granted access by users. The answer must focus on OAuth app risk. Which option meets the requirement with the least privilege?

Store client secrets in public codeUse company branding as the redirect URIGrant tenant wide admin consent to every app requestTarget the risky OAuth app instead of blocking all SaaS apps

OAuth app policies help govern risky app consent and access.

Managed identities

Mill Town Engineering has an Azure automation process. The process must access Key Vault without a secret in code. The resource supports managed identities. Which two choices should be included?

Enable a managed identity and grant it access to Key VaultUse password hash synchronisation to publish the appManaged identity settings and Key Vault access logsAssign every user Application Administrator

Managed identities avoid storing application secrets for supported Azure resources.

Service principals

Blink Inc has a daemon application outside Azure. The app must authenticate without a signed in user. Managed identity is not available for this workload. Which two choices should be included?

Use an app registration and service principal with application permissionsUse sign in logs as client credentialsApp registration, service principal, and sign in logsDisable consent review

Service principals represent application identities when managed identity is not available.

Enterprise application SSO

Liver Shipping is adding a SaaS application. Only selected users should access the app through Microsoft Entra SSO. The answer must control assignment. Which two choices should be included?

Configure the enterprise application SSO and assign users or groupsCreate a shared user account for the applicationEnterprise application sign in logs and assignment detailsUse a custom domain as the app role

Enterprise applications handle SSO, assignment, and app specific access for many SaaS apps.

Application Proxy

Whippet Exports has an internal web app. Remote users need access without exposing the internal network broadly. The app remains on premises. Which two choices should be included?

Publish the app with Microsoft Entra Application ProxyStore client secrets in public codeApplication Proxy connector health and sign in logsUse company branding as the redirect URI

Application Proxy publishes supported on premises web apps through Microsoft Entra.

User provisioning

Blink Inc wants SaaS app accounts to match Microsoft Entra assignments. User creation and removal should be automated. The SaaS app supports provisioning. Which two choices should be included?

Configure automatic user provisioning for the enterprise applicationUse password hash synchronisation to publish the appProvisioning logsAssign every user Application Administrator

Provisioning logs show account creation, update, and removal activity in target apps.

Admin consent

Mill Town Engineering reviews a third party app request. The app requests high privilege Microsoft Graph application permissions. Consent must be controlled. Which two choices should be included?

Use an admin consent review or workflow before granting tenant wide consentUse sign in logs as client credentialsAudit logs and app consent recordsDisable consent review

Admin consent should be controlled for high impact permissions.

App registration authentication

Blink Inc is registering a web application. The app must sign users in securely. The answer must include correct platform settings. Which two choices should be included?

Configure redirect URIs and authentication settings for the app registrationCreate a shared user account for the applicationApp registration settings and sign in logsUse a custom domain as the app role

App registration authentication settings must match the application platform and flow.

API permissions

Blink Inc is building an API client. The app must call Microsoft Graph without a signed in user. The answer must not use delegated permissions. Which two choices should be included?

Configure the required application permissions and grant admin consentStore client secrets in public codeAPI permissions and consent recordsUse company branding as the redirect URI

Application permissions are used when the app acts without a signed in user.

Defender for Cloud Apps

Mill Town Engineering wants to control risky cloud app sessions. The control must inspect activity during a session. The answer must integrate with Conditional Access where required. Which two choices should be included?

Configure Conditional Access app control with Defender for Cloud AppsUse password hash synchronisation to publish the appDefender for Cloud Apps policy logsAssign every user Application Administrator

Conditional Access app control can route sessions through Defender for Cloud Apps.

OAuth app governance

Whippet Exports is reviewing risky OAuth apps. The team must identify and control apps granted access by users. The answer must focus on OAuth app risk. Which two choices should be included?

Use Defender for Cloud Apps policies for OAuth appsUse sign in logs as client credentialsOAuth app governance and Defender for Cloud Apps alertsDisable consent review

OAuth app policies help govern risky app consent and access.

Plan and implement an identity governance strategy50 questions

Learning Path | 3 hr 23 min

Entitlement management, access reviews, PIM, logs, KQL, workbooks, reports, and Identity Secure Score.

Catalogues

Whippet Exports is structuring partner access. Resources for partner requests must be grouped for governance. The answer must support access packages. What should you recommend?

Create a catalogue for the partner resourcesMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Catalogues hold resources used by entitlement management.

Access packages

Whippet Exports needs partner access with approval and expiry. Partners need Teams, SharePoint, and app access for a project. The answer must support request, approval, and lifecycle. What should you recommend?

Use app roles as KQL queriesCreate an access package with request policy, approval, and expiry settingsUse terms of use to replace MFADisable review recommendations without a reason

Access packages bundle resources and policies for governed access.

Liver Shipping requires users to accept a policy before accessing finance apps. Acceptance must be recorded. The answer must not replace MFA. What should you recommend?

Use a custom domain as the PIM approval processUse licence assignment as audit historyConfigure terms of use and require acceptance for the target access flowAsk users to email screenshots of access

Connected organisations

Whippet Exports works with two regular broker tenants. Partner users should request access through a governed relationship. The answer must represent the partner organisations. What should you recommend?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewConfigure connected organisations for the partner tenants

Connected organisations support external access governance in entitlement management.

Access reviews

Liver Shipping must review guest access monthly. Review decisions must be recorded and acted on. The answer must cover existing access. What should you recommend?

Create a recurring access review for guest accessMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Access reviews validate whether existing access should continue.

PIM for Microsoft Entra roles

Mill Town Engineering wants to reduce standing admin rights. Administrators should activate roles only when required. The answer must support approval and audit. What should you recommend?

Use app roles as KQL queriesConfigure PIM eligible assignments for Microsoft Entra rolesUse terms of use to replace MFADisable review recommendations without a reason

PIM reduces standing privilege through eligible role activation.

PIM for Azure resources

Mill Town Engineering has subscription administrators. Azure resource roles should use just in time activation. The answer must apply to Azure resources. What should you recommend?

Use a custom domain as the PIM approval processUse licence assignment as audit historyConfigure PIM for Azure resource role assignmentsAsk users to email screenshots of access

PIM can manage eligible assignments for Azure resource roles.

PIM for Groups

Blink Inc uses a group to grant privileged application access. Membership should require activation. The answer must control group membership. What should you recommend?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewConfigure PIM for Groups

PIM for Groups controls activation for privileged group membership or ownership.

Diagnostics and KQL

Blink Inc wants to query identity logs. The team must run KQL against sign in and audit data. The answer must send logs to the right destination. What should you recommend?

Configure diagnostic settings to send Microsoft Entra logs to Log AnalyticsMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

KQL queries run against Log Analytics data, so logs must be sent there first.

Identity Secure Score

Whippet Exports wants to improve identity security posture. The team needs prioritised recommendations. The answer must support measurable improvement. What should you recommend?

Use app roles as KQL queriesReview Identity Secure Score recommendationsUse terms of use to replace MFADisable review recommendations without a reason

Identity Secure Score helps prioritise identity security improvements.

Catalogues

Whippet Exports is structuring partner access. Resources for partner requests must be grouped for governance. The answer must support access packages. What should you do first?

Use a custom domain as the PIM approval processUse licence assignment as audit historyIdentify the resources and owners for the catalogueAsk users to email screenshots of access

Catalogues hold resources used by entitlement management.

Access packages

Whippet Exports needs partner access with approval and expiry. Partners need Teams, SharePoint, and app access for a project. The answer must support request, approval, and lifecycle. What should you do first?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewCreate or select the catalogue and resources

Access packages bundle resources and policies for governed access.

Liver Shipping requires users to accept a policy before accessing finance apps. Acceptance must be recorded. The answer must not replace MFA. What should you do first?

Create the terms document and target policyMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Connected organisations

Whippet Exports works with two regular broker tenants. Partner users should request access through a governed relationship. The answer must represent the partner organisations. What should you do first?

Use app roles as KQL queriesConfirm the partner tenant domains and sponsorship modelUse terms of use to replace MFADisable review recommendations without a reason

Connected organisations support external access governance in entitlement management.

Access reviews

Liver Shipping must review guest access monthly. Review decisions must be recorded and acted on. The answer must cover existing access. What should you do first?

Use a custom domain as the PIM approval processUse licence assignment as audit historyDefine the review scope, reviewers, recurrence, and outcome behaviourAsk users to email screenshots of access

Access reviews validate whether existing access should continue.

PIM for Microsoft Entra roles

Mill Town Engineering wants to reduce standing admin rights. Administrators should activate roles only when required. The answer must support approval and audit. What should you do first?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewIdentify privileged roles and current assignments

PIM reduces standing privilege through eligible role activation.

PIM for Azure resources

Mill Town Engineering has subscription administrators. Azure resource roles should use just in time activation. The answer must apply to Azure resources. What should you do first?

Onboard the subscription or resource to PIM managementMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

PIM can manage eligible assignments for Azure resource roles.

PIM for Groups

Blink Inc uses a group to grant privileged application access. Membership should require activation. The answer must control group membership. What should you do first?

Use app roles as KQL queriesIdentify the privileged group and membership requirementsUse terms of use to replace MFADisable review recommendations without a reason

PIM for Groups controls activation for privileged group membership or ownership.

Diagnostics and KQL

Blink Inc wants to query identity logs. The team must run KQL against sign in and audit data. The answer must send logs to the right destination. What should you do first?

Use a custom domain as the PIM approval processUse licence assignment as audit historyCreate or select the Log Analytics workspaceAsk users to email screenshots of access

KQL queries run against Log Analytics data, so logs must be sent there first.

Identity Secure Score

Whippet Exports wants to improve identity security posture. The team needs prioritised recommendations. The answer must support measurable improvement. What should you do first?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewBaseline the current score and planned improvement actions

Identity Secure Score helps prioritise identity security improvements.

Catalogues

Whippet Exports is structuring partner access. Resources for partner requests must be grouped for governance. The answer must support access packages. Which source should you use to confirm the result?

Entitlement management catalogue configurationMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Catalogues hold resources used by entitlement management.

Access packages

Whippet Exports needs partner access with approval and expiry. Partners need Teams, SharePoint, and app access for a project. The answer must support request, approval, and lifecycle. Which source should you use to confirm the result?

Use app roles as KQL queriesAccess package request and assignment historyUse terms of use to replace MFADisable review recommendations without a reason

Access packages bundle resources and policies for governed access.

Liver Shipping requires users to accept a policy before accessing finance apps. Acceptance must be recorded. The answer must not replace MFA. Which source should you use to confirm the result?

Use a custom domain as the PIM approval processUse licence assignment as audit historyTerms of use acceptance recordsAsk users to email screenshots of access

Connected organisations

Whippet Exports works with two regular broker tenants. Partner users should request access through a governed relationship. The answer must represent the partner organisations. Which source should you use to confirm the result?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewConnected organisation and access package records

Connected organisations support external access governance in entitlement management.

Access reviews

Liver Shipping must review guest access monthly. Review decisions must be recorded and acted on. The answer must cover existing access. Which source should you use to confirm the result?

Access review results and audit logsMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Access reviews validate whether existing access should continue.

PIM for Microsoft Entra roles

Mill Town Engineering wants to reduce standing admin rights. Administrators should activate roles only when required. The answer must support approval and audit. Which source should you use to confirm the result?

Use app roles as KQL queriesPIM audit history and activation logsUse terms of use to replace MFADisable review recommendations without a reason

PIM reduces standing privilege through eligible role activation.

PIM for Azure resources

Mill Town Engineering has subscription administrators. Azure resource roles should use just in time activation. The answer must apply to Azure resources. Which source should you use to confirm the result?

Use a custom domain as the PIM approval processUse licence assignment as audit historyPIM for Azure resources audit historyAsk users to email screenshots of access

PIM can manage eligible assignments for Azure resource roles.

PIM for Groups

Blink Inc uses a group to grant privileged application access. Membership should require activation. The answer must control group membership. Which source should you use to confirm the result?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewPIM for Groups activity and audit logs

PIM for Groups controls activation for privileged group membership or ownership.

Diagnostics and KQL

Blink Inc wants to query identity logs. The team must run KQL against sign in and audit data. The answer must send logs to the right destination. Which source should you use to confirm the result?

Log Analytics query resultsMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

KQL queries run against Log Analytics data, so logs must be sent there first.

Identity Secure Score

Whippet Exports wants to improve identity security posture. The team needs prioritised recommendations. The answer must support measurable improvement. Which source should you use to confirm the result?

Use app roles as KQL queriesIdentity Secure Score history and recommendation statusUse terms of use to replace MFADisable review recommendations without a reason

Identity Secure Score helps prioritise identity security improvements.

Catalogues

Whippet Exports is structuring partner access. Resources for partner requests must be grouped for governance. The answer must support access packages. Which option meets the requirement with the least privilege?

Use a custom domain as the PIM approval processUse licence assignment as audit historyDelegate catalogue ownership only to the responsible teamAsk users to email screenshots of access

Catalogues hold resources used by entitlement management.

Access packages

Whippet Exports needs partner access with approval and expiry. Partners need Teams, SharePoint, and app access for a project. The answer must support request, approval, and lifecycle. Which option meets the requirement with the least privilege?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewUse an access package rather than permanent manual access

Access packages bundle resources and policies for governed access.

Liver Shipping requires users to accept a policy before accessing finance apps. Acceptance must be recorded. The answer must not replace MFA. Which option meets the requirement with the least privilege?

Require terms only for the relevant users or appsMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

Connected organisations

Whippet Exports works with two regular broker tenants. Partner users should request access through a governed relationship. The answer must represent the partner organisations. Which option meets the requirement with the least privilege?

Use app roles as KQL queriesCreate partner specific connected organisationsUse terms of use to replace MFADisable review recommendations without a reason

Connected organisations support external access governance in entitlement management.

Access reviews

Liver Shipping must review guest access monthly. Review decisions must be recorded and acted on. The answer must cover existing access. Which option meets the requirement with the least privilege?

Use a custom domain as the PIM approval processUse licence assignment as audit historyReview only the target guest access rather than all tenant usersAsk users to email screenshots of access

Access reviews validate whether existing access should continue.

PIM for Microsoft Entra roles

Mill Town Engineering wants to reduce standing admin rights. Administrators should activate roles only when required. The answer must support approval and audit. Which option meets the requirement with the least privilege?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewUse eligible assignments instead of permanent active assignments

PIM reduces standing privilege through eligible role activation.

PIM for Azure resources

Mill Town Engineering has subscription administrators. Azure resource roles should use just in time activation. The answer must apply to Azure resources. Which option meets the requirement with the least privilege?

Use eligible Azure resource role assignmentsMake every administrator permanently activeUse DNS records as access packagesDelete audit logs before investigation

PIM can manage eligible assignments for Azure resource roles.

PIM for Groups

Blink Inc uses a group to grant privileged application access. Membership should require activation. The answer must control group membership. Which option meets the requirement with the least privilege?

Use app roles as KQL queriesMake users eligible for the group rather than permanent membersUse terms of use to replace MFADisable review recommendations without a reason

PIM for Groups controls activation for privileged group membership or ownership.

Diagnostics and KQL

Blink Inc wants to query identity logs. The team must run KQL against sign in and audit data. The answer must send logs to the right destination. Which option meets the requirement with the least privilege?

Use a custom domain as the PIM approval processUse licence assignment as audit historySend only required log categories to the workspaceAsk users to email screenshots of access

KQL queries run against Log Analytics data, so logs must be sent there first.

Identity Secure Score

Whippet Exports wants to improve identity security posture. The team needs prioritised recommendations. The answer must support measurable improvement. Which option meets the requirement with the least privilege?

Create one permanent guest account for all partnersUse company branding to approve access requestsUse password hash synchronisation as an access reviewPrioritise relevant recommendations rather than enabling every control blindly

Identity Secure Score helps prioritise identity security improvements.

Catalogues

Whippet Exports is structuring partner access. Resources for partner requests must be grouped for governance. The answer must support access packages. Which two choices should be included?

Create a catalogue for the partner resourcesMake every administrator permanently activeEntitlement management catalogue configurationUse DNS records as access packages

Catalogues hold resources used by entitlement management.

Access packages

Whippet Exports needs partner access with approval and expiry. Partners need Teams, SharePoint, and app access for a project. The answer must support request, approval, and lifecycle. Which two choices should be included?

Create an access package with request policy, approval, and expiry settingsUse app roles as KQL queriesAccess package request and assignment historyUse terms of use to replace MFA

Access packages bundle resources and policies for governed access.

Liver Shipping requires users to accept a policy before accessing finance apps. Acceptance must be recorded. The answer must not replace MFA. Which two choices should be included?

Configure terms of use and require acceptance for the target access flowUse a custom domain as the PIM approval processTerms of use acceptance recordsUse licence assignment as audit history

Connected organisations

Whippet Exports works with two regular broker tenants. Partner users should request access through a governed relationship. The answer must represent the partner organisations. Which two choices should be included?

Configure connected organisations for the partner tenantsCreate one permanent guest account for all partnersConnected organisation and access package recordsUse company branding to approve access requests

Connected organisations support external access governance in entitlement management.

Access reviews

Liver Shipping must review guest access monthly. Review decisions must be recorded and acted on. The answer must cover existing access. Which two choices should be included?

Create a recurring access review for guest accessMake every administrator permanently activeAccess review results and audit logsUse DNS records as access packages

Access reviews validate whether existing access should continue.

PIM for Microsoft Entra roles

Mill Town Engineering wants to reduce standing admin rights. Administrators should activate roles only when required. The answer must support approval and audit. Which two choices should be included?

Configure PIM eligible assignments for Microsoft Entra rolesUse app roles as KQL queriesPIM audit history and activation logsUse terms of use to replace MFA

PIM reduces standing privilege through eligible role activation.

PIM for Azure resources

Mill Town Engineering has subscription administrators. Azure resource roles should use just in time activation. The answer must apply to Azure resources. Which two choices should be included?

Configure PIM for Azure resource role assignmentsUse a custom domain as the PIM approval processPIM for Azure resources audit historyUse licence assignment as audit history

PIM can manage eligible assignments for Azure resource roles.

PIM for Groups

Blink Inc uses a group to grant privileged application access. Membership should require activation. The answer must control group membership. Which two choices should be included?

Configure PIM for GroupsCreate one permanent guest account for all partnersPIM for Groups activity and audit logsUse company branding to approve access requests

PIM for Groups controls activation for privileged group membership or ownership.

Diagnostics and KQL

Blink Inc wants to query identity logs. The team must run KQL against sign in and audit data. The answer must send logs to the right destination. Which two choices should be included?

Configure diagnostic settings to send Microsoft Entra logs to Log AnalyticsMake every administrator permanently activeLog Analytics query resultsUse DNS records as access packages

KQL queries run against Log Analytics data, so logs must be sent there first.

Identity Secure Score

Whippet Exports wants to improve identity security posture. The team needs prioritised recommendations. The answer must support measurable improvement. Which two choices should be included?

Review Identity Secure Score recommendationsUse app roles as KQL queriesIdentity Secure Score history and recommendation statusUse terms of use to replace MFA

Identity Secure Score helps prioritise identity security improvements.

30 day cram guide

Print this page to PDF from your browser, or download the ebook version.

Download ebook Donate

Practise reading KQL queries for sign in analysis and review Microsoft Entra workbooks and reports.

Scenario: Mill Town Engineering

Day 29: Identity Secure Score

Review score improvement actions, risk trade offs, and how to explain recommendations to stakeholders.

Scenario: Whippet Exports

Day 30: Final review

Take a timed quiz, review wrong answers, check the Microsoft Learn change log, and revisit weak objectives.

Scenario: All companies

Control Alt Delete Tech Bits – Microsoft Entra ID, Intune, Windows 11 guides and troubleshooting

Microsoft Identity and Access Administrator

Objective map

Implement and manage user identities

Implement authentication and access management

Plan and implement workload identities

Plan and automate identity governance

Case studies

Overview

Identity environment

Cloud environment

Requirements

You need to allow the Belfast helpdesk to reset passwords only for Belfast users. What should you configure first?

You need to validate the MFA policy before users are affected. What should you use?

Which two sources should you review to troubleshoot Conditional Access results for a user sign in?

Overview

Identity environment

Cloud environment

Requirements

You need to let a new starter register Microsoft Authenticator without issuing a permanent password. What should you create?

You need to respond automatically when a user has high sign in risk. What should you configure?

Which two items should you review before enforcing passwordless registration?

Overview

Identity environment

Cloud environment

Requirements

You need an Azure automation process to access Key Vault without storing a secret in code. What should you use?

You need administrators to activate roles only when required. What should you configure?

Which two features should you compare when choosing how to synchronise AD DS identities?

Overview

Identity environment

Cloud environment

Requirements

You need partners to request access to Teams and SharePoint resources with approval and expiry. What should you create?

You need to control inbound collaboration from a trusted partner tenant. What should you configure?

Which two settings should you define for a monthly guest access review?

Study material

How to read an SC-300 case study

Delegated administration

Authentication and risk

Workload and privileged identities

Governed external access

Prepare for the exam

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. What should you recommend?

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. What should you recommend?

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. What should you recommend?

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. What should you recommend?

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. What should you recommend?

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. What should you recommend?

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. What should you recommend?

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. What should you recommend?

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. What should you recommend?

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. What should you recommend?

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. What should you do first?

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. What should you do first?

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. What should you do first?

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. What should you do first?

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. What should you do first?

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. What should you do first?

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. What should you do first?

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. What should you do first?

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. What should you do first?

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. What should you do first?

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. Which source should you use to confirm the result?

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. Which source should you use to confirm the result?

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. Which source should you use to confirm the result?

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. Which source should you use to confirm the result?

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. Which source should you use to confirm the result?

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. Which source should you use to confirm the result?

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. Which source should you use to confirm the result?

Mill Town Engineering is modernising access to cloud workloads. The design must use identity as the main access control point. The answer must work across users, apps, and workloads. Which source should you use to confirm the result?

Whippet Exports is assigning a support role. The support user needs to manage only one narrow task. The answer must avoid broad tenant rights. Which source should you use to confirm the result?

Liver Shipping is practising case study questions. The team must choose answers that meet all stated requirements. Some answer choices meet one requirement but break another. Which source should you use to confirm the result?

Liver Shipping is preparing a Conditional Access rollout. The identity team must explain how Zero Trust changes access decisions. The answer must not rely only on trusted network locations. Which option meets the requirement with the least privilege?

Blink Inc is reviewing a failed access attempt. The team must explain why a user can sign in but still cannot open an application. The answer must separate identity proof from access rights. Which option meets the requirement with the least privilege?

Mill Town Engineering is troubleshooting an app that receives Microsoft identity platform tokens. The developer must know which token is used by an API to authorise access. The answer must not treat tokens as passwords. Which option meets the requirement with the least privilege?

Whippet Exports is choosing identity services for partner access. The company needs controlled collaboration with external users. Partners should keep their own organisation identities where possible. Which option meets the requirement with the least privilege?

Blink Inc wants to use advanced governance and risk features. The security lead must confirm whether the tenant can use the planned controls. The answer must avoid assuming every Microsoft Entra feature is available. Which option meets the requirement with the least privilege?

Liver Shipping is investigating who changed a tenant setting. The team must identify the evidence source for a configuration change. The answer must not use user reports as the main evidence. Which option meets the requirement with the least privilege?

Blink Inc is investigating a blocked user sign in. The support team must see whether Conditional Access affected the sign in. The answer must show policy outcome evidence. Which option meets the requirement with the least privilege?