SC-300 Exam Study Guide: How I Renewed Without Crying Into My Authenticator App

The SC-300 exam is the one I point people at when they ask which Microsoft certification is worth their evenings. I have just renewed my Microsoft Identity and Access Administrator Associate certification, and the renewal reminded me how far Microsoft Entra ID has moved since I first sat it.

If you are preparing for the full exam, or your renewal reminder has just landed between two phishing simulations and a password reset ticket, this guide is for you.

I cover the exam facts, the skills measured and their weightings, the 28 October 2026 update, memory tips, scenario-style examples of how questions are framed, and the study plan I actually use.

Everything here links back to my free SC-300 study guide and practice questions, which goes deeper on every objective.

Never miss a guide: subscribe here and check out my YouTube channel.

Why I renewed my SC-300 instead of letting it lapse

When my renewal window opened, I was tempted to let it expire. I hold several Microsoft certifications, and there is always a shiny new badge waving at you from LinkedIn.

Ten minutes with the renewal modules changed my mind. Authentication strengths, cross-tenant access settings, Conditional Access templates, identity governance and PIM had all grown since my first attempt.

The renewal is free, runs on Microsoft Learn rather than at a Pearson VUE test centre, and opens 6 months before your certification expires. It is shorter than the full SC-300 exam, but it targets what has changed, so it is no gift.

I gave it 2 weeks of evenings and far too much tea. Pass before expiry and your certification is extended by 1 year from the expiry date, so renewing early costs you nothing.

SC-300 exam facts at a glance

These are the SC-300 exam numbers people ask me about most, checked against Microsoft Learn on 4 October 2026.

Item	Detail
Exam	SC-300: Microsoft Identity and Access Administrator
Certification earned	Microsoft Certified: Identity and Access Administrator Associate
Exam time	100 minutes, or 120 minutes if the exam contains labs
Seat time	Allow 120 minutes (140 with labs) for the agreement, instructions and comments
Number of questions	Most Microsoft exams have 40 to 60; no exact count is published
Passing score	700 on a scaled score, not a straight 70%
Price	Shown at booking and based on the country where you sit it
Validity	12 months
Renewal	Free, online, open book, unproctored, about 45 minutes
Next update	English version on 28 October 2026; other languages about 8 weeks later

Question types can include multiple choice, drag and drop, build list, hot area, active screen, case studies and labs. You aren’t told in advance which ones your exam will use, so try the exam sandbox before the day.

What changes in the SC-300 exam on 28 October 2026

The English SC-300 exam updates on 28 October 2026. The change log on the official SC-300 study guide marks three areas as minor changes:

• Plan, implement and manage Microsoft Entra user authentication
• Implement Global Secure Access
• Plan and implement privileged access

The 4 domain names and the audience profile stay the same. Sitting the SC-300 exam before 28 October? Use the earlier skills list. After that date, use the new one.

In the new list, the bullets worth reading twice include passkeys (FIDO2) and Temporary Access Pass, Microsoft Entra Kerberos for hybrid identities, the Microsoft traffic profile in Global Secure Access, and creating and managing emergency access accounts.

If that last one makes you twitch, my guide to break glass accounts covers it with fewer tears.

SC-300 skills measured and weightings

The SC-300 exam is split into 4 domains. The weightings are ranges, so use them to plan revision time, not to predict question counts.

Domain	Weighting	Main topics
Implement and manage user identities	20 to 25%	Tenant settings, roles, administrative units, users and groups, external users, cross-tenant sync, Microsoft Entra Connect Sync and Cloud Sync
Implement authentication and access management	25 to 30%	Authentication methods, MFA, SSPR, Windows Hello for Business, Conditional Access, ID Protection, Global Secure Access
Plan and implement workload identities	20 to 25%	Managed identities, enterprise apps, app registrations, consent, Application Proxy, Defender for Cloud Apps
Plan and automate identity governance	20 to 25%	Entitlement management, access reviews, PIM, emergency access accounts, logs, KQL, workbooks, Identity Secure Score

Memory tip: Users, Logins, Apps, Governance. ULAG. It sounds like a flat-pack wardrobe, which is exactly why it sticks.

How the SC-300 exam asks it, domain by domain

The SC-300 exam rarely asks where to click. It describes a business, adds a constraint, and asks for the most secure or least administrative option.

Below are example scenarios I wrote in that style, with option breakdowns and memory tips. They are practice examples, not real SC-300 exam questions.

User identities: hybrid and external users

Expect to choose between Microsoft Entra Connect Sync and Cloud Sync, and between password hash synchronisation (PHS), pass-through authentication (PTA) and federation.

Cloud Sync is now the recommended direction for most organisations and handles disconnected forests. Connect Sync is still needed for some jobs, such as device synchronisation for Microsoft Entra hybrid join and very large directories.

Memory tip: PHS keeps a copy, PTA phones home, federation hands someone else the door keys.

Example scenario. A user is disabled in on-premises AD at 9am and must lose cloud access straight away. The organisation uses PHS. What should you change?

• A. Run a manual sync every time an account is disabled. It works, but relies on someone remembering at 4:55pm on a Friday.
• B. Move to pass-through authentication. Passwords are validated against AD at sign-in, so a disabled account fails immediately. This is the answer the question is fishing for.
• C. Turn on single sign-on for domain-joined devices. Nicer for users, but it changes nothing about account state.
• D. Add a Conditional Access policy. Conditional Access has no idea the on-premises account is disabled.

PHS doesn’t enforce on-premises account state changes until they sync. PTA needs lightweight agents with access to your domain controllers, and 3 agents are recommended.

Authentication and Conditional Access

This is the biggest domain of the SC-300 exam. Know authentication methods, the built-in authentication strengths, SSPR, Windows Hello for Business, continuous access evaluation, authentication context and protected actions.

Conditional Access questions usually give you several policies and a user in an awkward state. Every policy in scope applies, a block beats a grant, and report-only policies log the result without enforcing it.

Memory tip: ID Protection detects, Conditional Access decides. One supplies the risk level, the other does something about it.

Example scenario. High-risk users must be made to secure their account automatically. The tenant has Microsoft Entra ID P2.

• A. Enable the user risk policy in ID Protection. That was the old answer, but the legacy policies retired on 1 October 2026.
• B. Create a Conditional Access policy with user risk set to High and the grant control require risk remediation or require password change. Correct.
• C. Create one policy that combines user risk and sign-in risk. Learn tells you to keep them in separate policies.
• D. Run an MFA registration campaign. Handy for getting people onto Authenticator, irrelevant to risk.

For sign-in risk, the usual control is MFA rather than a password change, and users need a registered MFA method before they can self-remediate.

Practise predicting outcomes with the Conditional Access What If tool. It is the closest thing to a revision aid Microsoft builds into the portal.

Workload identities and app access

Every app has an application object in its home tenant and a service principal in each tenant that uses it. Most consent and permission questions hinge on that distinction.

Memory tip: the application object is the recipe, the service principal is the meal served in your restaurant. Change the recipe and every restaurant notices; change your plate and only your diners do.

Know delegated versus application permissions, consent settings, the admin consent workflow, Application Proxy, and when to pick a system-assigned or user-assigned managed identity.

Example scenario. 3 Azure Functions need to read the same Key Vault, and you want a single identity to manage access for all of them.

• A. A system-assigned managed identity on each function. It works, but you now manage 3 identities, each deleted with its resource.
• B. One user-assigned managed identity shared by all 3. Correct: a standalone identity you can reuse across resources.
• C. An app registration with a client secret. Congratulations, you now own a secret and its expiry date.
• D. A service account user. Please don’t.

If consent settings still confuse you, my guide to restricting app consent in Entra ID walks through each option.

Identity governance and PIM

Entitlement management, access reviews, PIM and monitoring live here. Access packages bundle groups, apps and sites with policies for requests, approvals and expiry.

Memory tip: eligible is on the bench, active is on the pitch. PIM only lets people on when the manager calls them.

Example scenario. Global Administrators signed in with MFA this morning. They must authenticate again every time they activate the role.

• A. Set “On activation, require multifactor authentication”. Not enough, because users might not be prompted if they already did MFA earlier in the session.
• B. Create a Conditional Access authentication context, target it with a policy using sign-in frequency set to Every time, and select it in the PIM role settings. Correct.
• C. Make the assignments active instead of eligible. That removes activation entirely, the opposite of the goal.
• D. Require approval to activate. That adds a human, not an authentication prompt.

My guides to Microsoft Entra PIM and PIM for Groups cover these settings in a real tenant.

Monitoring counts too: sign-in, audit and provisioning logs, diagnostic settings, workbooks and KQL. Run a query like this in your lab until you can read it without squinting.

SigninLogs
| where TimeGenerated > ago(7d)
| where ConditionalAccessStatus == "failure"
| summarize Failures = count() by UserPrincipalName, AppDisplayName
| order by Failures desc

How to study for the SC-300 exam in 5 steps

My approach was the same for the original exam and the renewal. It isn’t glamorous, but it works.

Step 1: Read the official study guide

1. Open the SC-300 study guide on Microsoft Learn and check which skills list applies to your exam date.
2. Paste the bullets into a spreadsheet and rate yourself red, amber or green on each one.
3. Start with the red bullets in the authentication domain.

Step 2: Work through the Microsoft Learn course

1. Use the free learning paths behind course SC-300T00. The instructor-led version runs over 4 days if your employer is paying.
2. Take notes in your own words. If you can’t explain it to Dave from accounts, you don’t know it yet.

Step 3: Build a lab tenant and do the labs

The SC-300 lab instructions on GitHub walk through the hands-on tasks. You need a tenant with premium licences for most of them.

The Microsoft 365 Developer Program E5 sandbox is no longer free for everyone. It now needs a Visual Studio Professional or Enterprise subscription, a qualifying partner programme membership, or a Premier or Unified Support contract.

1. Check the Microsoft 365 Developer Program eligibility first. If you qualify, it is still the best option.
2. Otherwise, create a free Microsoft Entra tenant and activate a Microsoft Entra ID P1 or P2 trial. My guide to setting up a Microsoft Entra ID tenant helps here.
3. Use test users only, and set a calendar reminder before the trial ends.

Once your lab has a few Conditional Access policies, this Microsoft Graph PowerShell snippet lists them with their state:

Connect-MgGraph -Scopes "Policy.Read.All"
Get-MgIdentityConditionalAccessPolicy -All |
    Select-Object DisplayName, State |
    Sort-Object State, DisplayName

State shows enabled, disabled or enabledForReportingButNotEnforced, which is report-only wearing a very long name badge.

Step 4: Drill practice questions

1. Take the free SC-300 practice assessment on Microsoft Learn.
2. Then work through my SC-300 practice questions and 30-day study plan.
3. Drill in batches of 20 and write down the concept behind every wrong answer.
4. When you score above 85% on a full practice run 2 days in a row, book the exam.

Step 5: Rehearse the exam itself

1. Try the exam sandbox so the interface doesn’t eat your first 10 minutes.
2. Read every case study tab before answering anything.
3. Mark questions for review, but answer them all. A blank answer scores nothing.

Are you ready? A self-check before you book

Before booking the SC-300 exam, I make sure I can do all of these in a lab without looking anything up.

Task	Domain
Create an administrative unit and scope a role to it	User identities
Explain when Cloud Sync isn’t enough and Connect Sync is needed	User identities
Build a Conditional Access policy in report-only, test it with What If, then enable it	Authentication
Configure passkeys (FIDO2) and Temporary Access Pass in the authentication methods policy	Authentication
Register an app, add API permissions and grant admin consent	Workload identities
Create an access package with an expiry date and an access review	Governance
Configure PIM role settings and activate an eligible role	Governance
Send sign-in logs to Log Analytics and query them with KQL	Governance

Need a refresher on the authentication rows? See my guides to Temporary Access Pass and custom banned passwords and phishing-resistant MFA.

SC-300 exam gotchas that cost marks

Old practice material. Anything that still says Azure AD, or offers the ID Protection user risk policy as the answer, is out of date. Learn the current names, because the exam uses them.

Grant control logic. Within one policy you choose require all or require one of the selected controls. Across policies, everything in scope applies.

MFA on PIM activation. It doesn’t guarantee a fresh prompt. Authentication context with sign-in frequency set to Every time does.

Managed identity lifecycles. System-assigned identities are deleted with their resource. User-assigned ones live on until you remove them.

Scenario wording. “Minimise administrative effort” and “most secure” often point to different options. Read the last sentence of the question twice.

Should you take (or renew) the SC-300 exam?

If you manage Microsoft 365 or Entra ID, yes. Identity is where most incidents start, and the SC-300 exam makes you learn the features you have meant to switch on since 2021.

It also counts towards the Microsoft Cybersecurity Architect Expert certification. The prerequisite list changed when AZ-500 retired on 31 August 2026 and Cloud and AI Security Engineer Associate (SC-500) replaced it, so check the current list on the Cybersecurity Architect Expert page.

If you already hold it, renew it. The assessment is free and open book, and letting it lapse means sitting the full exam again. Nobody does case studies twice for fun.

SC-300 exam FAQs

Further reading

• Study guide for Exam SC-300 (Microsoft Learn)
• Microsoft Certified: Identity and Access Administrator Associate (Microsoft Learn)
• Exam duration and exam experience (Microsoft Learn)
• Renew your Microsoft Certification (Microsoft Learn)
• Configure and enable risk policies (Microsoft Learn)
• My free SC-300 study guide and practice questions
• Microsoft Entra PIM: secure admin access
• Why use administrative units in Entra ID

Found this useful? Buy me a coffee, and if you handle subject access requests, have a look at Redact Ninja for redacting PDFs without sending files to a server.