SC-300 authentication and access explained
Implement authentication and access management is the largest SC-300 domain at 25–30%. It covers how users prove who they are (authentication methods, MFA, SSPR, passwordless), when access is allowed (Conditional Access), how risk is handled (ID Protection) and how network access is secured (Global Secure Access). Expect scenario questions where a policy does not behave as expected.
User authentication
Methods
Authentication methods are enabled in the authentication methods policy, per method and per group. The ones the outline names:
| Method | Notes |
|---|---|
| Microsoft Authenticator | Push, number matching, passwordless phone sign-in |
| Passkeys (FIDO2) | Phishing-resistant; hardware keys or device passkeys |
| Certificate-based authentication | Sign in with an X.509 certificate, no federation needed |
| Temporary Access Pass (TAP) | Time-limited code for onboarding or recovery; lets a user register passwordless methods |
| Windows Hello for Business | Device-bound credential; hybrid deployment needs trust model planning |
A frequent scenario: a new hire has no registered method yet and needs to set up a passkey. Issue a Temporary Access Pass. Registration campaigns nudge users to register a stronger method such as Authenticator.
MFA, SSPR and password protection
Tenant-wide MFA settings include service settings and the methods policy. Self-service password reset can be enabled for a group first and needs registered methods; in a hybrid environment, password writeback is what makes the reset reach on-premises AD. Password protection blocks banned passwords, including a custom list, and can be extended to on-premises AD with agents. Microsoft Entra Kerberos lets hybrid identities get Kerberos tickets from Entra, which supports cloud trust for Windows Hello for Business. You may also need to disable an account and revoke user sessions after an incident.
Conditional Access
A policy is assignments (who, what, which conditions) plus access controls (grant or session).
| Part | Examples |
|---|---|
| Users and groups | Include and exclude users, roles, guest types, workload identities |
| Target resources | Apps, user actions, authentication context |
| Conditions | Sign-in risk, device platform, location, client apps, device filter |
| Grant | Block, require MFA, authentication strength, compliant device, terms of use, password change |
| Session | Sign-in frequency, persistent browser, app-enforced restrictions, Conditional Access app control, continuous access evaluation |
Rules that decide questions:
- All matching policies apply, and a block control wins over a grant.
- Policies are evaluated after first-factor authentication.
- Use report-only mode and the What If tool before enforcing.
- Exclude emergency access accounts from policies that could lock everyone out.
- Security defaults cannot be combined with Conditional Access policies.
- Authentication context lets a policy apply to a sensitive action inside an app; protected actions use it to require a policy for risky admin operations.
- Continuous access evaluation can revoke access near real time on events such as user disablement.
- Policy templates give a tested starting point.
To troubleshoot, open the sign-in log entry, check the Conditional Access tab for which policies applied and why, then reproduce with What If.
Manage risk with ID Protection
| Policy | Signal | Typical control |
|---|---|---|
| User risk | The account may be compromised (for example leaked credentials) | Require secure password change |
| Sign-in risk | This sign-in may not be the real user | Require MFA |
Both can be implemented in ID Protection or as Conditional Access policies. Review the risky users, risky sign-ins and risk detections reports, confirm or dismiss risk, and monitor risky workload identities. The features generally need Entra ID P2 licensing, so check the licence in the scenario.
Global Secure Access
Global Secure Access routes network traffic through Microsoft’s service. Learn the three pieces:
- The client installed on devices to acquire traffic.
- Private Access for internal apps without a VPN, via a private network connector.
- Internet Access and the Microsoft traffic profile for Microsoft 365 traffic, which can be tied to Conditional Access.
Sample questions
Question 1. A new employee has no authentication methods registered and must set up a passkey (FIDO2) on first sign-in. What should the helpdesk issue?
- A. A self-service password reset link
- B. A Temporary Access Pass
- C. The credentials of another administrator
- D. A one-time SMS code
Show answer
Answer: B
A Temporary Access Pass is a time-limited credential designed for bootstrapping: it lets a user sign in and register passwordless methods. A password reset link needs a registered method. A hardware token without registration cannot be used. Another administrator’s account must never be shared.
Want more questions like this? Full SC-300 practice tests →
Question 2. Two Conditional Access policies apply to a sign-in. Policy A grants access if MFA is satisfied. Policy B blocks access from unmanaged devices. The user signs in from an unmanaged device and completes MFA. What is the result?
- A. Access is granted because MFA was completed
- B. Access is granted because policy A is listed first
- C. Access is blocked by policy B
- D. The user is prompted for MFA a second time and then allowed
Show answer
Answer: C
Every matching policy is evaluated, and a block control takes precedence over a grant. Completing MFA satisfies policy A only. The sign-in is blocked by policy B. Policies are not alternatives, and there is no ordering where the first match wins.
Want more questions like this? Full SC-300 practice tests →
Question 3. You want sensitive admin actions in a portal to require a stronger authentication than normal sign-in, without applying that requirement to the whole app. Which Conditional Access capability should you use?
- A. A policy that targets the entire application with MFA
- B. A sign-in frequency session control
- C. A named location condition
- D. Authentication context
Show answer
Answer: D
Authentication context lets you tag a specific action or resource and target it with a Conditional Access policy, so only that step requires step-up. Targeting the whole app applies to every user action. Sign-in frequency controls re-authentication timing, not a per-action requirement. A named location restricts by network, not by action.
Want more questions like this? Full SC-300 practice tests →
What to practise
Build three policies in report-only mode (MFA for admins, compliant device for one app, block legacy authentication), read the results in the sign-in log, and use What If with a test user. Then configure a user risk policy and a registration campaign. Continue to workload identities.