Microsoft SC-300: Microsoft Identity and Access Administrator

Last checked October 22, 2026 against the official Microsoft exam page.

1. Question 1Implement authentication and access management

   A Conditional Access policy must block sign-ins from older clients that cannot complete modern authentication. Which condition should be configured?

   1. ADevice platforms set to Windows
   2. BSign-in risk set to high
   3. CLocations set to a trusted IP range
   4. DClient apps set to Other clients
   Show answer and explanationHide answer

   Correct answer: D

   The Other clients option under the client apps condition targets legacy authentication protocols such as basic authentication. The other conditions select devices, networks or risk levels and do not identify legacy protocols.

2. Question 2Implement identities in Microsoft Entra ID

   A company with an on-premises Active Directory wants users to sign in to Microsoft Entra ID with their on-premises passwords, and wants passwords validated on-premises without storing password hashes in the cloud. Which Microsoft Entra Connect sign-in method should be configured?

   1. APassword hash synchronization
   2. BPass-through authentication
   3. CActive Directory Federation Services
   4. DSeamless single sign-on only
   Show answer and explanationHide answer

   Correct answer: B

   Pass-through authentication sends each sign-in to an on-premises agent that validates the password against Active Directory, so no password hashes are stored in the cloud. Password hash synchronization stores hashes in Entra ID, and AD FS needs a federation farm the scenario does not ask for. Seamless SSO is a single sign-on add-on that works alongside a sign-in method rather than replacing it.

3. Question 3Plan and implement identity governance

   Which two features are part of Microsoft Entra ID Governance? (Choose two.)

   1. AAccess reviews
   2. BEntitlement management
   3. CAzure Firewall
   4. DAzure Bastion
   5. EMicrosoft Defender for Endpoint
   Show answer and explanationHide answer

   Correct answer: A, B

   Access reviews and entitlement management are identity governance capabilities in Entra ID Governance. Azure Firewall, Azure Bastion and Defender for Endpoint are network, remote access and endpoint security products, not governance features.

4. Question 4Plan and implement workload identities

   An Azure Function must read secrets from Azure Key Vault without storing any credentials in code or app settings. Which approach is recommended?

   1. AEmbed the Key Vault access key in the function source code and configuration
   2. BCreate a service principal and store its client secret in app settings for the function
   3. CEnable a system-assigned managed identity on the function and grant it access to the Key Vault
   4. DUse a shared administrator account with Global Administrator rights in the function code
   Show answer and explanationHide answer

   Correct answer: C

   A managed identity gives the function an Entra identity whose credentials Azure manages, so no secret is stored. The other options rely on stored secrets or shared accounts, which is exactly what this scenario is meant to avoid.

5. Question 5Implement authentication and access management

   A company wants administrators to hold privileged roles only when needed, with approval and a time limit on each activation. Which Microsoft Entra feature should be used?

   1. APrivileged Identity Management with eligible assignments
   2. BPermanent role assignments protected by MFA and a sign-in risk policy
   3. CAccess packages with no expiry date set on the assignment policy
   4. DAn Azure Policy initiative that audits resource tags and settings
   Show answer and explanationHide answer

   Correct answer: A

   Privileged Identity Management makes role assignments eligible, so users activate them for a set period, optionally after approval and MFA. Permanent assignments keep standing privilege, Azure Policy governs resource configuration, and access packages without expiry remove the time limit.