SC-300 identity governance explained
Plan and automate identity governance is worth 20–25% of SC-300. It covers entitlement management (access packages), access reviews, privileged access with Privileged Identity Management (PIM) and emergency access accounts, and monitoring identity activity with logs, KQL and workbooks. The principle behind all of it is that access should be requested, time-limited and reviewed.
Entitlement management
Entitlement management bundles access and automates its lifecycle.
| Object | Role |
|---|---|
| Catalog | A container of resources (groups, apps, SharePoint sites) and of delegated owners |
| Access package | A bundle of resource roles that a user requests as one item |
| Policy | Who can request, approval stages, expiry, and access reviews |
| Connected organization | A partner whose users may request packages |
| Terms of use | An agreement users must accept |
When an external user’s last access package expires, the account can be removed automatically; that is the lifecycle answer for guests. Delegated catalog owners let business owners manage their own packages without a tenant admin.
Access reviews
Access reviews ask the right people whether access is still needed. You configure:
- What to review: group membership, application access, access package assignments, or Entra and Azure roles (the last through PIM).
- Reviewers: group owners, managers, selected users, or users reviewing their own access.
- Recurrence and duration, and the default decision when a reviewer does not respond (for example remove access).
- Auto-apply results, so denied access is removed without manual action, and recommendations based on sign-in activity.
You also monitor reviews and respond manually when a reviewer is absent.
Privileged access with PIM
| Concept | Meaning |
|---|---|
| Eligible assignment | The user can activate the role when needed, but does not hold it standing |
| Active assignment | The role is in force now, permanently or until an end date |
| Activation settings | Maximum duration, MFA, justification, ticket information, approval |
| PIM for Groups | Just-in-time membership or ownership of a role-assignable or security group |
| Azure resources | Eligible Azure RBAC roles at subscription, resource group or resource scope |
Alerts, audit history and reports show who activated what. Standard guidance: make roles eligible, require MFA and justification, require approval for the most powerful roles, use short activation windows, and review assignments regularly.
Emergency access accounts
Create at least two cloud-only accounts with the Global Administrator role, not tied to a person, with long random passwords stored safely and, where possible, a phishing-resistant method. They are the way back in if Conditional Access or federation fails. Monitor them with alerts, and exclude them from policies that could lock everyone out.
Monitor identity activity
| Source | Shows |
|---|---|
| Sign-in logs | Interactive, non-interactive, service principal and managed identity sign-ins, with Conditional Access results |
| Audit logs | Changes to the directory: who did what |
| Provisioning logs | Results of syncing users to apps |
Diagnostic settings send these logs to a Log Analytics workspace, a storage account or an Event Hub. A workspace lets you run KQL, for example:
SigninLogs
| where ResultType != 0
| summarize failures = count() by UserPrincipalName
| top 10 by failures desc
That returns the ten users with the most failed sign-ins. Workbooks give ready-made visuals, and Identity Secure Score gives recommendations to improve posture. Pick storage for cheap long retention, Event Hubs for streaming to a SIEM, and Log Analytics for querying.
Sample questions
Question 1. Guests from a partner company need access to a SharePoint site and a Teams group for 90 days. Access must expire automatically and the guest account must be removed when no access remains. What should you use?
- A. Add the guests to the group and remind the owner to remove them
- B. Invite the guests with a permanent invitation
- C. A Conditional Access policy that blocks guests after 90 days
- D. An entitlement management access package with a 90-day expiry
Show answer
Answer: D
An access package in entitlement management with a 90-day expiry removes the assignments at the end, and the external user lifecycle setting removes the guest when their last package expires. A one-off group membership does not expire. A permanent invitation leaves the guest in the directory. A Conditional Access policy controls sign-in conditions, not provisioning.
Want more questions like this? Full SC-300 practice tests →
Question 2. Group owners must confirm each quarter that members of a sensitive group still need access. If an owner does not respond, members must be removed automatically. What should you configure?
- A. A one-time access review with managers as reviewers
- B. A quarterly recurring access review with group owners, default decision Remove access, and auto-apply
- C. A quarterly access review with default decision Approve access
- D. A PIM activation requirement for the group
Show answer
Answer: B
A recurring access review with group owners as reviewers, a default decision of remove access when nobody responds, and auto-apply of results meets the requirement. A one-time review does not repeat. Approving everyone by default keeps stale access. PIM activation rules apply to privileged roles, not to this membership review.
Want more questions like this? Full SC-300 practice tests →
Question 3. You need to keep sign-in logs for several years at the lowest cost, with no need for interactive queries. Where should you send them with a diagnostic setting?
- A. A Log Analytics workspace
- B. An Azure Event Hub
- C. A storage account
- D. A workbook
Show answer
Answer: C
A storage account gives inexpensive long-term retention for logs that do not need querying. A Log Analytics workspace is for interactive KQL analysis and costs more to retain at length. An Event Hub is for streaming to a SIEM or external tool, not archiving. Workbooks are visuals and store no logs.
Want more questions like this? Full SC-300 practice tests →
What to practise
Build an access package for a guest with expiry, a quarterly review of its group, an eligible role in PIM that needs approval, and create emergency access accounts. Send sign-in logs to Log Analytics and write three KQL queries. After that, check yourself with the practice test.