SC-300 study scenarios: choose your route

For SC-300, the right study route depends on which of the exam’s four domains you already operate: users and hybrid identity, authentication and Conditional Access, workload identities, or governance. The weights are close, Authentication and access management is largest at 25–30%, and the other three sit at 20–25% each. The exam is 100 minutes and needs 700 out of 1000, and the English outline changes on October 28, 2026.

Example profiles, not real people. The profiles below are illustrative planning examples built from the official exam outline. They are not reviews or reports of anyone’s result.

The study plan is four weeks at 8 to 10 hours a week for someone who administers Microsoft 365 or Entra ID, and doubles for someone who does not. The budgets here are planning assumptions that follow from that plan.

Profile one: the tenant administrator who lives in the Entra admin center

Starting point. Creates users and groups, assigns licences, writes Conditional Access policies and resets MFA methods. Hybrid sync was set up long ago and is rarely touched.

Where the time goes. The first two domains are mostly review. Time goes to the objectives that daily administration rarely covers, scattered across Plan and implement workload identities (20–25%) and Plan and automate identity governance (20–25%): app registrations, federated credentials, delegated versus application permissions, access packages, access reviews and PIM for groups. The plan also names cross-tenant synchronization, Global Secure Access, protected actions and authentication context.

The trap. Over-trusting familiarity. Policy-writing is a daily habit, but the exam asks why a policy did not apply and expects the sign-in log and What If tool to answer.

Suggested order. Workload identities, governance, then a verification pass through authentication.

Time budget. A planning assumption is two weeks, 16 to 20 hours, reflecting the plan’s advice to compress its first two weeks.

Profile two: the on-premises Active Directory engineer

Starting point. Knows forests, group policy, Kerberos and AD FS in depth, and has used Entra Connect. Cloud authentication, app consent and governance are new vocabulary.

Where the time goes. User identities (20–25%) is solid ground except cloud-side detail: Cloud Sync versus Entra Connect Sync, password hash sync versus pass-through authentication, and moving off AD FS. The largest domain, authentication and access management (25–30%), is a different model from group policy: authentication methods policy, Temporary Access Pass, passkeys, risk-based policies in ID Protection. Workload identities and governance are almost entirely new.

The trap. Mapping Active Directory concepts one to one. A service principal is not a service account, and entitlement management has no on-premises equivalent, so intuition from group policy misleads.

Suggested order. Authentication and Conditional Access first, because it is the largest domain, then workload identities, governance, and the user identities week as a cloud-detail review.

Time budget. A planning assumption is the standard four weeks, 32 to 40 hours, weighting authentication and workload identities most.

Profile three: the application developer who registers apps but does not run the tenant

Starting point. Has created app registrations, handled secrets and requested API permissions for their own code. Does not set tenant policy, run reviews or manage hybrid sync.

Where the time goes. Workload identities (20–25%) is familiar, but the exam goes beyond the developer view: managed identities, Application Proxy, consent settings, admin consent workflow and Defender for Cloud Apps policies. The other three domains are administrator territory: Conditional Access, hybrid identity, PIM and lifecycle governance.

The trap. Treating SC-300 as an application-security exam. Roughly three quarters of the weighting sits outside the developer’s day-to-day view.

Suggested order. User identities, authentication and access, governance, then a verification pass through workload identities.

Time budget. A planning assumption is six weeks, 48 to 60 hours, between the standard plan and the doubled one, because the developer has one domain solid and no administrative baseline.

The three SC-300 profiles compared

How to check which SC-300 route fits before booking

Take the free practice assessment cold and record the four domain scores. Then use the sample questions, the 20-question practice test and the exam format page, especially its note on the authentication domain’s weight. Pass or fail, the score report shows which of the four domains needs work.

If your focus is protecting data rather than identities, SC-401 is the neighbouring exam.