SC-300 user identities explained
Implement and manage user identities is worth 20–25% of SC-300. It covers four things: configuring the Microsoft Entra tenant (roles, administrative units, domains, settings), creating and managing identities, handling external users and other tenants, and connecting an on-premises directory. Most questions ask which tool, role or sync option fits a stated requirement.
Configure and manage the tenant
Roles and administrative units
Entra has built-in roles and, with the right licence, custom roles made from selected permissions. Roles are assigned at tenant scope, or scoped to an administrative unit (AU), a container of users, groups or devices. A scoped role applies only to the members of that AU. The classic scenario is a regional helpdesk that resets passwords only for its own staff. AUs can have static membership or dynamic membership rules. You are also expected to evaluate effective permissions: a user can hold several role assignments, and the result is the union of all of them.
Domains, branding and settings
You add and verify custom domains with a DNS record, and can change the primary domain. Company branding customises the sign-in page. Tenant properties, user settings (who can register applications, whether users can create tenants), group settings and device settings are all in scope.
Create and manage identities
Users, groups and attributes
Groups are security or Microsoft 365 groups, with assigned or dynamic membership. Dynamic membership rules need an Entra ID P1 licence or higher. Custom security attributes are business-specific key-value pairs on users or apps, used for attribute-based access control. They are managed through dedicated attribute roles; being Global Administrator does not by itself let you read or assign them.
Bulk operations are done in the Entra admin center from a CSV file or with PowerShell and Microsoft Graph PowerShell. Licences are assigned per user or, better, through group-based licensing.
Devices
| State | Meaning | Typical device |
|---|---|---|
| Microsoft Entra registered | Personal device, work account added | BYOD phone or laptop |
| Microsoft Entra joined | Organisation-owned, signs in with a work account | Cloud-only corporate laptop |
| Microsoft Entra hybrid joined | Joined to on-premises AD and registered in Entra | Domain-joined Windows device |
Know the difference: join is for corporate devices, registration is for personal ones.
External users and tenants
| Feature | Use it to |
|---|---|
| External collaboration settings | Control who can invite guests and which domains are allowed or blocked |
| Bulk invitation | Invite many guests from a CSV file |
| Cross-tenant access settings | Set inbound and outbound B2B rules per partner organisation, and optionally trust the partner’s MFA and device claims |
| Cross-tenant synchronization | Automatically provision users between tenants of the same multi-tenant organisation |
| External identity providers | Federate with a partner using SAML or WS-Fed, or with supported social providers |
A recurring scenario is two companies after an acquisition who want users in both tenants to see each other without separate guest invitations: cross-tenant synchronization. Another is avoiding a double MFA prompt for guests: configure inbound trust of the partner’s MFA claims in cross-tenant access settings.
Hybrid identity
| Option | Key idea |
|---|---|
| Entra Connect Sync | Full-featured sync server; supports complex topologies and many options, including device sync |
| Entra Cloud Sync | Lightweight agent managed from the cloud; suits multiple disconnected forests and simple topologies |
| Password hash sync (PHS) | Hash of the hash synchronised; sign-in is validated in the cloud |
| Pass-through authentication (PTA) | Agents validate the password against on-premises AD at sign-in |
| Seamless SSO | Domain-joined devices on the corporate network sign in without typing a password |
| AD FS | Federation to migrate away from, to PHS or PTA with Entra |
| Connect Health | Monitors the sync and federation components |
If a requirement says passwords must be checked against on-premises AD in real time, the answer is PTA. If it says to keep working when the on-premises environment is down, PHS fits.
Sample questions
Question 1. Contoso acquired Fabrikam. Both have their own Microsoft Entra tenant. Users in each company must appear in the other's directory automatically, without sending individual invitations. What should you implement?
- A. Send a bulk guest invitation from a CSV file every month
- B. Change the external collaboration settings to allow all domains
- C. Configure cross-tenant synchronization
- D. Build an AD FS trust between the two organisations
Show answer
Answer: C
Cross-tenant synchronization provisions users from a source tenant into a target tenant automatically, for organisations that belong to the same multi-tenant organisation. Inviting each user manually does not scale. External collaboration settings only control who may invite and which domains are allowed. A new AD FS trust federates sign-in but does not provision directory objects.
Want more questions like this? Full SC-300 practice tests →
Question 2. A company has three disconnected Active Directory forests with no network connectivity between them. It wants to synchronise all users to a single Entra tenant with the least infrastructure to maintain. Which tool fits best?
- A. Microsoft Entra Connect Sync on a single server
- B. Seamless single sign-on
- C. Pass-through authentication
- D. Microsoft Entra Cloud Sync with an agent in each forest
Show answer
Answer: D
Entra Cloud Sync uses lightweight agents managed from the cloud and supports multiple disconnected forests. Entra Connect Sync is a heavier server-based tool and expects connectivity between forests in a multi-forest topology. Seamless SSO and pass-through authentication are sign-in features, not provisioning tools.
Want more questions like this? Full SC-300 practice tests →
Question 3. Employees use their own laptops and phones to read work email. IT does not own these devices and must not take over the device sign-in. Which device state should apply?
- A. Microsoft Entra registered
- B. Microsoft Entra joined
- C. Microsoft Entra hybrid joined
- D. Domain joined only
Show answer
Answer: A
Microsoft Entra registered is the state for personal, BYOD devices: a work account is added without the organisation managing the whole device sign-in. Entra joined and hybrid joined are for organisation-owned devices, and hybrid join also requires on-premises AD domain membership.
Want more questions like this? Full SC-300 practice tests →
What to practise
Create an administrative unit with a scoped role, a dynamic group, a bulk guest invite, an org-specific cross-tenant access setting with MFA trust, and read the sync options in the Entra Connect documentation until you can state the one difference between PHS and PTA that decides most questions. Then move on to authentication and access management.