SC-300: Identity and Access Administrator Associate

Up to date with latest October 28th exam objectives.

What is a Microsoft Entra tenant?

A dedicated identity directory and trust boundary for an organisation.

What is the difference between tenant ID and tenant domain?

Tenant ID is a GUID; domain is a verified sign-in suffix.

What is the initial default tenant domain format?

tenantname.onmicrosoft.com.

Why verify a custom domain in Entra?

To prove domain ownership and use it for user sign-in names.

What type of DNS record commonly verifies a custom domain?

A TXT record supplied by Microsoft.

What does company branding customise?

Sign-in experience, such as logo and background.

What are Entra built-in roles?

Microsoft-defined sets of directory administrative permissions.

How do custom Entra roles differ from built-in roles?

Custom roles contain administrator-selected supported permissions.

What does the Global Administrator role control?

Broad Microsoft Entra and integrated service administrative access.

Which principle should guide directory role assignment?

Least privilege: only permissions needed for the task.

What is an administrative unit (AU)?

A scope for delegating administration over selected directory objects.

Does membership in an administrative unit grant administrator rights?

No; a role must be assigned at the appropriate scope.

When are administrative units useful?

Delegating regional or departmental user administration.

What limits an AU-scoped User Administrator?

Its authority is constrained to supported objects within that AU.

Does AU scoping restrict every Microsoft Entra role?

No; only supported roles and operations are scoped.

What does effective permission mean for an admin?

The permissions resulting from applicable role assignments and scopes.

Can one user hold multiple Microsoft Entra role assignments?

Yes; their effective privileges reflect applicable assignments.

What is the difference between Entra roles and Azure RBAC roles?

Entra roles manage directory resources; Azure RBAC governs Azure resources.

Where are user and group settings managed?

In Microsoft Entra ID tenant settings and relevant admin areas.

Why limit the ability to register applications?

To control creation of workload identities and consent exposure.

What is tenant-wide collaboration policy used for?

Setting default permissions for inviting and interacting with external users.

What is a verified UPN suffix?

A user sign-in domain that the tenant has proven it owns.

What is a tenant's primary domain?

The preferred domain designation for new users in the tenant.

Why inspect Entra role assignments regularly?

To identify unnecessary standing administrative access.

What is a cloud-only user?

A user created and managed directly in Microsoft Entra ID.

What is a synchronised user?

A cloud identity whose core attributes are sourced from on-prem AD.

What is the User Principal Name (UPN)?

The sign-in identifier, commonly user@domain.

How is UPN different from email address?

They can match, but sign-in name and mail routing are different properties.

What does a security group primarily provide?

A reusable identity collection for access assignments.

What does a Microsoft 365 group provide?

Shared collaboration resources such as a group mailbox and SharePoint site.

Assigned membership vs dynamic membership?

Manual group membership versus rule-based automatic membership.

Which expression joins two dynamic group conditions?

-and requires both predicates to be true.

Which expression allows either dynamic group condition?

-or requires at least one predicate to be true.

How do you filter dynamic groups to guests?

Use a rule on user.userType equal to Guest.

What changes when a user's attributes affect dynamic group membership?

Membership is reevaluated against the rule.

What is a custom security attribute?

A defined key-value identity attribute for supported authorisation and filtering.

How do custom security attributes differ from extension attributes?

They use a dedicated attribute definition model and permission controls.

What is group-based licensing?

Assigning licences to a group so supported member users inherit them.

A user loses a licence assigned via a group. What should you inspect?

Group membership, licensing assignment and conflicts/errors.

What is direct licensing?

Assigning a product licence to an individual user.

What is a common requirement to assign a product licence?

Set an appropriate usage location and have available licences.

What is a soft-deleted Entra user?

A deleted user recoverable during the supported retention period.

What is the typical user-deletion recovery window?

30 days for a standard soft-deleted Entra user.

What is Microsoft Entra registered device state?

Personal or BYOD-style device registered for organisational identity access.

What is Microsoft Entra joined device state?

A device joined directly to Entra as its primary identity directory.

What is Microsoft Entra hybrid joined device state?

A device joined to on-prem AD and registered with Entra.

What does bulk user creation offer?

Create or modify many users using supported import or automation tools.

Why prefer automation for repetitive user onboarding?

Consistency, repeatability and reduced manual errors.

What is automatic app user provisioning?

Creating and updating application users from identity lifecycle data.

What protocol is commonly used for SaaS user provisioning?

SCIM (System for Cross-domain Identity Management).

What does a service principal represent in a tenant?

The tenant-local instance of an application identity.

A user can sign in but lacks a paid Microsoft 365 feature. What check comes first?

Verify the service licence and service-plan enablement.

What is Microsoft Entra B2B collaboration?

Sharing apps and resources with people from outside your organisation.

What is a B2B guest account in a resource tenant?

A local representation of an externally authenticated collaborator.

Does a guest always authenticate with a resource-tenant password?

No; guests generally authenticate through their home identity provider.

What does invitation redemption mean?

The invited person accepts or completes their B2B invitation.

Does successful B2B invitation grant access to every app?

No; application and resource authorisation still applies.

Which setting controls who may invite guest users?

External collaboration guest invitation restrictions.

What is the Guest Inviter directory role for?

Enabling authorised people to invite B2B guests under applicable settings.

What do external collaboration domain restrictions do?

Allow or block B2B invitations from specified email domains.

How can multiple B2B guests be invited efficiently?

Bulk invitation using supported CSV or automation.

What does Guest versus Member userType specify?

User classification and default directory permissions, not necessarily authentication origin.

Can a B2B identity have UserType set to Member?

Yes; classification can differ from authentication origin.

What is an external identity provider?

A trusted service used to authenticate external collaborators.

Which federation protocols can support external organisational IdPs?

SAML 2.0 or WS-Federation in supported scenarios.

When might B2B email one-time passcodes be used?

When eligible guests lack another supported authentication method.

What is B2B direct connect commonly used for?

Teams shared channels across organisations.

How does Teams external access differ from guest access?

External access enables cross-org chat/calls without guest team membership.

What is inbound cross-tenant access?

External users accessing resources in your tenant.

What is outbound cross-tenant access?

Your users accessing resources in another tenant.

An external user is blocked by resource-tenant inbound policy. What must change?

The resource tenant must permit the applicable inbound access.

What are organisation-specific cross-tenant settings?

Partner-specific overrides of default cross-tenant policies.

What three external signals can cross-tenant inbound trust accept?

MFA, compliant-device and hybrid-joined-device claims.

Does inbound MFA trust turn off Conditional Access?

No; it permits external MFA evidence to satisfy supported requirements.

What is cross-tenant synchronisation?

Automating B2B user lifecycle provisioning between Microsoft Entra tenants.

Does cross-tenant synchronisation synchronise user passwords?

No; authentication remains with the user's home identity.

Why use cross-tenant synchronisation in multi-tenant companies?

To automate access identity creation, updates and removals.

What are issuer, holder and verifier in Verified ID?

Issuer creates a credential; holder presents it; verifier validates it.

What proves a verifiable credential was not altered?

Cryptographic verification of signature and issuer.

What can resetting B2B redemption address?

Problems with a guest's linked external authentication relationship.

What is the effect of changing guest visibility settings?

Changes permitted directory information access, not automatic app assignments.

What is hybrid identity?

Identities spanning on-premises AD and Microsoft Entra ID.

What is Microsoft Entra Connect Sync?

An on-prem sync engine moving supported directory identity data into Entra.

What is Microsoft Entra Cloud Sync?

A cloud-managed directory provisioning service using on-prem agents.

What is the sourceAnchor used for?

Stable matching of an on-prem identity to its cloud identity.

What cloud property reflects an on-prem source anchor?

onPremisesImmutableId.

What AD attribute is often used as a user source anchor?

ms-DS-ConsistencyGuid in supported modern Connect Sync configurations.

What is hard matching in hybrid identity?

Linking objects using the immutable/source-anchor identifier.

What is soft matching in hybrid identity?

Matching supported existing cloud users by UPN or primary SMTP.

Why plan UPN suffixes before directory synchronisation?

To avoid mismatched or unverified cloud sign-in names.

Can Entra verify a private .local domain as a public custom domain?

No; use an owned, verifiable public domain suffix.

What are the three key Connect Sync phases?

Import, synchronise and export.

What is a connector space?

The sync engine's representation of objects from one connected directory.

What is the metaverse in Connect Sync?

Its combined internal identity representation.

What is a synchronisation rule?

Logic controlling joins, filtering and attribute flows.

What is a staging-mode Connect Sync server?

A standby engine that imports/synchronises without normal exports.

What is Password Hash Synchronization (PHS)?

Cloud validation using a protected derivative of AD password hashes.

Does PHS send plaintext passwords to Entra?

No; it synchronises processed hash information, not plaintext passwords.

Can existing PHS cloud sign-ins survive a temporary AD outage?

Yes, if the relevant password was already synchronised.

What is Pass-through Authentication (PTA)?

Entra delegates password checks to on-premises agents and AD.