SC-300 workload identities explained
Plan and implement workload identities is worth 20–25% of SC-300. It covers identities for applications and Azure workloads (managed identities and service principals), enterprise applications, app registrations and app access monitoring with Microsoft Defender for Cloud Apps. The main skill is choosing the right identity or permission type for a described application.
Identities for applications and Azure workloads
| Identity | Use when |
|---|---|
| System-assigned managed identity | One Azure resource needs credentials; the identity is deleted with the resource |
| User-assigned managed identity | Several resources share an identity, or it must outlive a resource |
| Service principal (with secret, certificate or federated credential) | The workload runs outside Azure, or in a pipeline, and needs its own identity |
| User account | Interactive or legacy scenarios that cannot use a workload identity (avoid for automation) |
| Managed service account | On-premises Windows services running under AD |
The preferred answer in nearly every scenario is a managed identity, because there is no secret to store or rotate. You create one, assign it to an Azure resource, give it an RBAC role on the target resource, and the app requests tokens without credentials.
Enterprise applications
An enterprise application is the service principal of an app in your tenant: it holds assignments, SSO configuration and consent. Tasks in scope:
- SaaS integration: SAML or OIDC single sign-on from the gallery, optional automatic provisioning.
- On-premises apps: Application Proxy publishes an internal web app through a connector installed on-premises, with Entra pre-authentication and Conditional Access in front of it.
- Assignment: users, groups and app roles can be assigned; turning on assignment required blocks anyone not assigned.
- Roles: roles such as Application Administrator and Cloud Application Administrator manage enterprise apps; the least-privilege choice is narrower than Global Administrator.
- Application collections group apps on the My Apps portal.
Consent
| Consent | Who grants | Typical limit |
|---|---|---|
| User consent | The user, for permissions that need no admin | Can be restricted to verified publishers and low-risk permissions, or turned off |
| Admin consent | An administrator, for the whole tenant | Required for application permissions and some high-privilege delegated ones |
The admin consent workflow lets users request approval when they cannot consent themselves, which is the usual answer when users see an “approval required” prompt.
App registrations
An app registration is the definition of an application (the object a developer creates). Tasks in scope:
- Authentication: redirect URIs, supported account types (single or multiple tenants), and credentials: certificates and federated credentials are preferred over client secrets.
- API permissions: delegated permissions act on behalf of a signed-in user; application permissions act as the app with no user and always need admin consent.
- App roles: custom roles defined on the app, assigned to users, groups or other apps, and returned in tokens.
A simple memory aid: if a person is present, delegated; if a daemon or script runs alone, application.
Defender for Cloud Apps
| Capability | What it does |
|---|---|
| Cloud discovery | Analyses traffic logs to show which cloud apps are used, with risk scores |
| Connected apps | Connects via API to see activity and apply governance in sanctioned apps |
| Conditional Access app control | Proxies sessions to enforce access and session policies in real time |
| Access and session policies | Block downloads, require labelling or monitor within a session |
| OAuth app policies | Detect and act on risky third-party app permissions |
| Cloud app catalog | Risk assessment of thousands of apps; mark apps sanctioned or unsanctioned |
If a scenario says to block file downloads to unmanaged devices from a SaaS app without blocking access entirely, the answer is a session policy through Conditional Access app control.
Sample questions
Question 1. A web app on Azure App Service must read secrets from Azure Key Vault. The security team does not want any credentials stored in app settings or code. What should you use?
- A. A system-assigned managed identity with access to the key vault
- B. A service principal with a client secret kept in app settings
- C. A shared user account with a long password
- D. A certificate stored in the application’s configuration file
Show answer
Answer: A
A managed identity, with a Key Vault role or access policy granted to it, lets the app obtain tokens without any stored secret. A client secret or certificate in app settings is still a stored credential. A user account with a password is a credential too and is hard to rotate.
Want more questions like this? Full SC-300 practice tests →
Question 2. Users in your tenant see a prompt saying approval is required when they try to sign in to a new third-party app. You want them to be able to request approval from a reviewer instead of being blocked. What should you enable?
- A. Allow user consent for all apps
- B. Assign the users the Application Administrator role
- C. The admin consent workflow
- D. Turn off assignment required on the application
Show answer
Answer: C
The admin consent workflow lets users send a request to designated reviewers when they cannot grant consent themselves. Allowing all user consent removes the safeguard. Adding the users as Application Administrators is excessive. Turning off assignment required has no effect on the consent prompt.
Want more questions like this? Full SC-300 practice tests →
Question 3. An internal web application is hosted on a server in the corporate network. Remote employees must reach it without a VPN, with Conditional Access and MFA enforced at sign-in. What should you deploy?
- A. A guest invitation for each employee
- B. Microsoft Entra Application Proxy with a connector on the network
- C. Cloud discovery in Defender for Cloud Apps
- D. A user-assigned managed identity
Show answer
Answer: B
Microsoft Entra Application Proxy publishes the on-premises web app through a connector, with pre-authentication in Entra so Conditional Access applies. A guest invitation is for external users. Cloud discovery reports app usage but does not publish an app. Moving to a managed identity solves a different problem, credentials for Azure resources.
Want more questions like this? Full SC-300 practice tests →
What to practise
Create a managed identity and use it to read a secret. Register an app with an application permission, grant admin consent, then restrict user consent and turn on the workflow. Publish a test site with Application Proxy, and build a session policy in Defender for Cloud Apps. Continue to identity governance.