ExamSprintLab

SC-300 study plan: pass in 4 weeks

Updated October 9, 2026

Four weeks is realistic for SC-300 if you already administer Microsoft 365 or Entra ID and study 8–10 hours a week. Follow the order of the outline: users and hybrid identity first, then authentication and Conditional Access (the largest domain), then applications and workload identities, then governance and monitoring. Without any Microsoft 365 administration experience, double the timeline and look at the SC-900 guide first.

Before you start

  • Read the official skills outline once, end to end. Note the version date: the English outline changes on October 28, 2026.
  • Get a test tenant. A Microsoft 365 developer or trial tenant with Entra ID P2 and Entra ID Governance features turned on lets you try PIM, ID Protection and entitlement management. Licensing requirements vary, so check which licence each feature needs before you build a lab.
  • Take the free Microsoft practice assessment cold. The score does not matter yet; the per-domain breakdown does.
  • Create two cloud-only emergency access accounts early. Creating them is an exam objective.

Week 1: user identities (20–25%)

Goal: build the tenant, the identities and the hybrid link.

  • Tenant: built-in versus custom roles, administrative units, custom domains, company branding, tenant, user, group and device settings.
  • Identities: users, groups (assigned and dynamic), custom security attributes, bulk operations in the portal and PowerShell, device join versus registration, licence assignment.
  • External users: external collaboration settings, bulk invites, cross-tenant access settings, cross-tenant synchronization, SAML and WS-Fed identity providers.
  • Hybrid: Entra Connect Sync versus Cloud Sync, password hash sync, pass-through authentication, seamless SSO, moving away from AD FS, Connect Health.

Lab: an administrative unit with a scoped helpdesk role, a dynamic group, a guest invited in bulk, and an org-specific cross-tenant access setting for a partner tenant.

Week 2: authentication and access management (25–30%)

Goal: control how people sign in and when access is allowed.

  • Authentication: methods policy, certificate-based authentication, Temporary Access Pass, Authenticator, passkeys, tenant-wide MFA, SSPR, Windows Hello for Business, password protection, Kerberos for hybrid.
  • Conditional Access: assignments, conditions, grant and session controls, report-only mode, the What If tool, authentication context, protected actions, continuous access evaluation, templates.
  • ID Protection: user risk and sign-in risk policies, registration campaigns, investigating risky users and workload identities.
  • Global Secure Access: the client, Private Access, Internet Access, the Microsoft traffic profile.

Lab: require MFA for admins in report-only mode, read the results, then enforce; add a policy that requires a compliant device for one app; issue a Temporary Access Pass and register a passkey.

Week 3: workload identities (20–25%)

Goal: register, integrate and secure applications.

  • Azure workloads: system- and user-assigned managed identities, service principals, when to use which.
  • Enterprise apps: SAML SSO for SaaS apps, Application Proxy for on-premises apps, user and admin consent, assignment and app roles, application collections.
  • App registrations: redirect URIs, secrets, certificates and federated credentials, delegated versus application API permissions, app roles.
  • Defender for Cloud Apps: cloud discovery, connected apps, Conditional Access app control, OAuth app policies.

Lab: register an app with an API permission that needs admin consent, restrict user consent and enable the admin consent workflow, publish a test web app through Application Proxy.

Week 4: identity governance and review (20–25%)

Goal: limit standing access and prove it.

  • Entitlement management: catalogs, access packages, approval and expiry, connected organizations, terms of use, external user lifecycle.
  • Access reviews: reviewers, recurrence, recommendations, auto-apply, handling no-response.
  • Privileged access: PIM for Entra roles, Azure resources and groups, activation settings and approval, audit history, emergency access accounts.
  • Monitoring: sign-in, audit and provisioning logs, diagnostic settings, KQL in Log Analytics, workbooks, Identity Secure Score.

Lab: an access package for a guest with a 30-day expiry, a monthly access review of that group, an eligible role in PIM that needs approval, and a KQL query that lists failed sign-ins.

Review: take the free 20-question practice test mid-week, repeat the official practice assessment, then spend the remaining days on your weakest domain.

If you already administer Entra ID

Compress weeks 1 and 2. Spend the saved time on the objectives that day-to-day administration rarely covers: cross-tenant synchronization, Global Secure Access, protected actions, authentication context, PIM for Groups, Defender for Cloud Apps session policies and KQL.

How to know you are ready

  • You can say why a Conditional Access policy did not apply, using the sign-in log and What If.
  • You can tell eligible from active, delegated from application permission, and system- from user-assigned managed identity without hesitating.
  • You can read a short KQL query against the sign-in logs and say what it returns.
  • You score 80% or more on realistic practice questions twice in a row, on different sets.

Then book it. See the exam format for the mechanics and the exam day guide for the day itself.