SC-300 prerequisites: what you need first
SC-300 has no required prerequisite certification: the certification page for Identity and Access Administrator Associate lists none, so anyone can book it. Microsoft does state a background, though: “You should be familiar with Azure, Microsoft 365 services and workloads, and Active Directory Domain Services (AD DS). You should also be familiar with PowerShell and Kusto Query Language (KQL).” The questions assume it, and this page turns it into a checklist.
What Microsoft says
The certification page describes a role that designs, implements and operates identity and access management using Microsoft Entra, covering users, devices, Azure resources and applications, and applying Zero Trust principles. The quoted sentence above is the whole of the background requirement. No years of experience are published. The page also announces that the English version is updated on 28 October 2026; see the exam format for what changed.
The background that helps
Microsoft 365 and Azure
You should know what a tenant is, how licences are assigned, and what the main workloads are. Entra ID sits under all of them. Without that context, features such as app consent or guest access make little sense.
Active Directory Domain Services
Hybrid identity is in the outline, so you should know what a domain, a user object and a group are, and why on-premises accounts are synchronised to the cloud. The user identities guide builds on it.
Authentication concepts
Passwords, multifactor authentication, passwordless sign-in, tokens, and the difference between authentication and authorisation. This supports the largest domain; see authentication and access.
Applications and OAuth
An app registration, a service principal and a consent grant. Even a simple understanding of what happens when an app asks for permission to read a mailbox helps with workload identities.
PowerShell and KQL
You should read a short Microsoft Graph PowerShell command and a short KQL query, such as filtering sign-in logs, and say what they return. Writing them from scratch is rarely needed.
Governance basics
Roles, approvals, and periodic review of access. See identity governance.
If you come from a different background
Helpdesk and desktop support staff often know accounts and password resets well but not Conditional Access or entitlement management; give those the most lab time. On-premises AD administrators usually know users and groups but meet app registrations, consent and workload identities for the first time. Developers tend to understand tokens and OAuth but have little experience of governance features such as access reviews. Matching the study order to your weakest area saves more time than following the outline from the top.
Allow extra time if you have never worked in an Entra tenant. The is-it-hard guide says how much.
What you do not need
| Not needed | Why |
|---|---|
| SC-900 | Not listed as a requirement; useful vocabulary only |
| AZ-104 or another Azure certification | None listed |
| Software development | Reading small snippets is enough |
| On-premises AD administration experience | Familiarity is enough; depth helps with hybrid questions |
| A paid tenant | A free developer or trial tenant covers many labs, though some features need licences |
Self-check
- What is the difference between a user, a group and a service principal?
- Why does a company synchronise on-premises accounts to the cloud?
- What does a Conditional Access policy decide, and when is it evaluated?
- Who approves access in a lifecycle workflow, and why review it later?
- Can you read a one-line KQL query that counts failed sign-ins per user?
Two or more gaps: spend a week in a trial tenant, then use the study plan.
Where it leads
Many people follow SC-300 with a security exam. See SC-300 versus SC-401, and how hard SC-300 is.