SC-300 cheat sheet
Last-minute reference for SC-300. Authentication and access management is the largest area; the other three are about equal.
Exam facts
| Duration | 100 minutes |
| Passing score | 700 / 1000 |
| Price | Set per country or region; shown at booking |
| Languages | 10 |
| Renewal | Free, every 12 months |
| Outline | As of October 28, 2026 (English) |
Skill areas
| Area | Weight |
|---|---|
| Implement and manage user identities | 20–25% |
| Implement authentication and access management | 25–30% |
| Plan and implement workload identities | 20–25% |
| Plan and automate identity governance | 20–25% |
Requirement to feature
| Requirement | Answer |
|---|---|
| Admin rights for a subset of users only | Role scoped to an administrative unit |
| Membership follows an attribute | Dynamic group (needs P1 or higher) |
| Link two tenants of one organisation | Cross-tenant synchronization |
| Skip repeat MFA for partner guests | Inbound trust of MFA claims in cross-tenant access settings |
| Several forests, minimal infrastructure | Entra Cloud Sync |
| Sign-in survives an on-premises outage | Password hash sync |
| Passwords checked on-premises | Pass-through authentication |
| Bootstrap passwordless | Temporary Access Pass |
| Gradual push to Authenticator | Registration campaign |
| SSPR must change on-premises password | Password writeback |
| Try a policy without enforcing | Report-only mode, What If |
| Step-up for one action | Authentication context |
| Revoke access in near real time | Continuous access evaluation |
| Compromised credentials | User risk policy: password change |
| Suspicious sign-in | Sign-in risk policy: MFA |
| Private apps, no VPN | Entra Private Access |
| Secret-free access from an Azure resource | Managed identity |
| Secret-free access from a pipeline | Federated credential |
| Daemon calls an API | Application permission plus admin consent |
| Users can’t consent | Admin consent workflow |
| On-premises web app, Conditional Access in front | Application Proxy |
| Block downloads in a SaaS session | Session policy via Conditional Access app control |
| Time-limited partner access | Access package with expiry |
| Recurring check of access | Access review with auto-apply |
| Standing admin access removed | PIM eligible assignment |
| Lockout recovery | Two cloud-only emergency accounts |
| Query sign-ins | SigninLogs in Log Analytics |
Conditional Access rules
- All matching policies apply; block beats grant.
- Evaluated after first-factor authentication.
- Test in report-only mode and with What If.
- Exclude emergency access accounts.
- Security defaults and Conditional Access cannot be combined.
Quick distinctions
| Pair | Difference |
|---|---|
| Delegated vs application | A user is present vs no user, admin consent |
| Eligible vs active | Needs activation vs in force now |
| System vs user-assigned identity | One resource vs shared and reusable |
| Joined vs registered vs hybrid | Corporate cloud-only; personal; corporate and in AD |
| App registration vs enterprise application | The app’s definition vs the service principal in your tenant |
| Log Analytics vs storage vs Event Hubs | Query; cheap archive; stream |
Common traps
- Assuming Global Administrator reads custom security attributes: it needs the attribute roles.
- Forgetting that application permissions always require admin consent.
- Hiding an app from My Apps and thinking access is blocked: use assignment required.
- Treating a report-only policy as enforced.
- Using a one-time review where a recurring one is asked.
See the study plan and the practice test to apply this.