--- title: "SC-300 Study Guide — Identity and Access Administrator Associate" description: "An interactive study guide built on 7 memory techniques to help you pass SC-300 -designing, implementing, and operating identity and access with Microsoft Entra." url: "https://lucidlabs.com.au/insights/sc-300" --- # Master the SC-300 An interactive study guide built on 7 memory techniques to help you pass SC-300 -designing, implementing, and operating identity and access with Microsoft Entra. Implement and manage user identities ~25%Implement authentication and access management ~25%Plan and implement workload identities ~25%Plan and implement identity governance ~25% What it covers Microsoft Entra ID user and group lifecycle, external identities (B2B collaboration, B2B direct connect, Entra External ID), hybrid identity (Entra Connect, Entra Connect Cloud Sync, PHS/PTA/federation), authentication methods and MFA, Conditional Access, Identity Protection risk policies, single sign-on and app integration, workload identities (service principals, managed identities, workload identity federation), Privileged Identity Management, entitlement management, access reviews, and Lifecycle Workflows. Ideal for Security engineers and identity administrators who design, implement, and operate an organisation’s identity and access management using Microsoft Entra. Aspire to this if You're responsible for applying Zero Trust principles to identity, giving users seamless self-service access, and modernising a hybrid identity estate -while keeping privileged access tightly governed. Section 1 / Spatial Memory ## The Map Tap any component to see what you need to know for the exam. **👤 Entra ID Core** Users · Groups · Licences **🌐 External Identities** B2B · B2B Direct Connect · External ID **🔗 Hybrid Identity** Entra Connect · Cloud Sync **🔐 Authentication Methods** MFA · Passwordless · SSPR **🚦 Conditional Access** Signals · Controls · Sessions **⚠️ Identity Protection** User Risk · Sign-in Risk **🔑 SSO & App Integration** Enterprise Apps · SAML/OIDC · SCIM **🤖 Workload Identities** Service Principals · Managed Identities **🤝 Workload Identity Federation** Federated Credentials · OIDC Trust **⏱️ Privileged Identity Management** Eligible · Just-in-Time · Approval **📦 Entitlement Mgmt & Access Reviews** Access Packages · Recertification **🔄 Lifecycle Workflows** Joiner · Mover · Leaver Section 2 / Narrative Memory ## The Story Follow the narrative to build a mental model of how everything connects. 👤 ### The Identity Ledger Every identity story starts in the Entra ID core -the ledger of every user, guest, and group in the tenant. Members and guests sit side by side, dynamic groups recalculate their membership as attributes change, and licences flow automatically to whoever belongs to the right group. Administrative units let a regional admin manage only their slice of the directory. **Exam Intel**Member vs Guest = different default permissions. Dynamic groups = rule-based membership (attribute expressions). Group-based licensing = automatic SKU assignment. Administrative units = scoped delegated administration. 🌐 ### Opening the Gates to Partners When work crosses organisational boundaries, External Identities opens the gate. B2B collaboration invites a partner to sign in with their own credentials -no new password to manage. When the relationship is deep enough that partner users should feel like insiders, B2B direct connect builds two-way trust instead. Cross-tenant access settings are the fine print governing exactly how much each partner tenant is trusted. **Exam Intel**B2B collaboration = guest invited, uses home identity. B2B direct connect = mutual trust, used for Teams Shared Channels. Cross-tenant access settings = per-partner inbound/outbound trust configuration. Entra External ID = CIAM for customer-facing apps. 🔗 ### The Bridge from On-Prem For organisations still running Active Directory Domain Services, Entra Connect -or its lighter cousin, Cloud Sync -builds the bridge to the cloud. Behind that bridge sits a choice: sync a password hash of a hash (PHS), validate passwords live against on-prem AD (PTA), or hand authentication entirely to a federation server. Staged rollout lets you test the cutover on a pilot group before flipping the whole tenant. **Exam Intel**Entra Connect Sync = full-featured, single forest focus. Cloud Sync = lightweight agents, multi-forest support, cloud-managed. PHS = lowest maintenance + leaked credential detection. PTA = real-time validation, agents required. Federation = AD FS, highest complexity. 🔐 ### Proving Who You Are Before any resource is touched, the user has to prove who they are. The authentication methods policy governs every path in: Authenticator passwordless sign-in, a FIDO2 security key tapped against a laptop, Windows Hello unlocking with a glance, or a Temporary Access Pass bootstrapping a brand-new starter into passwordless before they’ve set up anything else. **Exam Intel**Authentication methods policy = converged MFA + SSPR management. Passwordless = Windows Hello for Business, FIDO2, Authenticator. TAP = time-limited passcode for bootstrapping. CBA = certificate/smart card sign-in. SSPR + password writeback resets the on-prem password too. 🚦 ### The Conditional Access Checkpoint Past authentication, every request hits the Conditional Access checkpoint. Signals -who, what app, what device, where from, how risky -feed into an if-then policy engine. Grant controls demand more proof (MFA, a compliant device); session controls limit what happens once access is granted, like forcing re-authentication every few hours from an unmanaged device. **Exam Intel**Signals: user/group, app, device platform, location, client app, sign-in risk. Grant controls: MFA, compliant device, hybrid joined, approved app. Session controls: sign-in frequency, persistent browser, Conditional Access App Control. Always pilot new policies in report-only mode. ⚠️ ### Reading the Risk Signals Identity Protection watches every sign-in and every account for signs of compromise. A sign-in from an anonymous IP raises sign-in risk for that single session; a leaked credential match raises user risk that lingers until the user changes their password or an admin steps in. Risk-based Conditional Access policies turn those signals into automatic action -no analyst has to be watching in real time. **Exam Intel**Sign-in risk = per-session, e.g. anonymous IP, atypical travel. User risk = persists until remediated, e.g. leaked credentials. Risk levels: low/medium/high drive distinct CA policies. Remediation: SSPR (user risk) or MFA (sign-in risk). Requires Entra ID P2. 🔑 ### One Sign-In, Every App Once trusted, the user shouldn’t have to prove themselves again for every app. Enterprise apps -backed by app registrations -hand out SAML or OIDC tokens for true single sign-on. SCIM keeps the target app’s user list in sync automatically, and Application Proxy extends that same seamless experience to an ageing on-prem web app that was never built for the cloud. **Exam Intel**App registration = app’s identity definition. Enterprise app = tenant instance you assign users/groups to. SSO protocols: SAML 2.0, OIDC/OAuth 2.0, password-based, linked. SCIM = automated provisioning/deprovisioning. App Proxy = publish on-prem apps without a VPN. 🤖 ### When the Caller Isn’t a Person Not every identity in the tenant belongs to a human. A scheduled job, a CI/CD pipeline, or an Azure Function needs its own identity to call APIs -that’s a service principal, backed by a managed identity so no developer ever has to store a secret. System-assigned identities live and die with their resource; user-assigned ones can be shared across a whole fleet of resources. **Exam Intel**Service principal = local representation of an app in the tenant. System-assigned managed identity = tied to one resource’s lifecycle. User-assigned managed identity = standalone, shareable. Managed identities remove the need for stored credentials entirely. 🤝 ### Trusting a Token from Elsewhere Sometimes the caller lives entirely outside Entra -a GitHub Actions pipeline, a Kubernetes pod. Workload identity federation lets that external workload present its own OIDC token and exchange it for an Entra access token, with zero secrets stored on either side. Entra checks the issuer, subject, and audience claims on that incoming token before it trusts it with anything. **Exam Intel**Federated credentials = exchange external OIDC token for Entra token, no stored secret. Common exam scenario: GitHub Actions deploying to Azure via OIDC. Trust is scoped by issuer + subject + audience claims. Workload ID Premium adds Conditional Access and risk detection for service principals. ⏱️ ### Standing Access Becomes Just-in-Time Privileged Identity Management refuses to let any role sit "always on" if it doesn’t have to. An eligible Global Administrator activates their role only when they need it -with MFA, a justification, maybe an approver’s sign-off -and the clock starts ticking the moment activation happens. PIM for Groups pulls the same trick for sensitive group membership, not just directory roles. **Exam Intel**Eligible = inactive until activated; Active = always on. Activation requirements: MFA, justification, ticket, approval. Time-bound assignments have start/end dates. PIM for Groups extends JIT to group membership/ownership. Recurring access reviews recertify eligible role holders. 📦 ### Requesting Access, Reviewing Access Entitlement management turns "can I get access to X" into a governed, self-service request: an access package bundles the apps, groups, and Teams a new project needs, routed through an approval policy -or auto-assigned by attribute with no request at all. Access reviews then loop back periodically, asking a manager or resource owner "does this person still need this?" -and can auto-remove access if nobody answers. **Exam Intel**Access package = bundle of apps/groups/Teams behind one request. Catalogs group resources; connected orgs extend packages to partners. Auto-assignment = attribute-based, no request needed. Access reviews: self/manager/resource-owner reviewers, auto-apply results on completion or non-response. 🔄 ### The Automatic Onboarding Line Lifecycle Workflows sits upstream of all of it, automating the joiner-mover-leaver line so nothing depends on a human remembering a checklist. An HR attribute change -a hire date landing tomorrow -triggers a workflow that creates the account, generates a Temporary Access Pass, and adds the right groups, all before the new starter’s first coffee. On the way out, a leaver workflow strips licences and disables the account on schedule. **Exam Intel**Lifecycle Workflows = built-in JML automation. Triggers: attribute-based (e.g. employeeHireDate) or time-based. Tasks: welcome email, group add, TAP generation, licence removal, account disable. Custom task extensions call Logic Apps. Complements entitlement management rather than replacing it. Section 3 / Acronym Memory ## Mnemonic Wall Memorable acronyms and phrases to anchor key exam concepts in your memory. 👤 MGAL **M**ember/guest, **G**roups (dynamic), **A**dministrative units, **L**icensing (group-based) The four building blocks of Entra ID core identity management -who they are, how they’re grouped, who administers them, and how they’re licensed. 🔗 PPF **P**assword hash sync, **P**ass-through auth, **F**ederation The three hybrid authentication methods Entra Connect can configure, in order of increasing complexity and decreasing cloud dependency. 🔐 WFCT **W**indows Hello, **F**IDO2, Authenticator (**C**onnect), **T**emporary Access Pass The passwordless and bootstrapping methods tested on SC-300: Windows Hello for Business, FIDO2 keys, Authenticator passwordless, and TAP to get a new user started. 🚦 SGCB **S**ignals, **G**rant controls, session (**C**ontrols), **B**lock Conditional Access policy anatomy: evaluate signals, then either grant with controls attached, apply session controls, or block outright. ⏱️ EMAT **E**ligible, **M**FA on activation, **A**pproval, **T**ime-bound PIM activation flow: a role starts eligible, activation can require MFA and approval, and every assignment can be time-bound with start/end dates. 📦 ACAR **A**ccess packages, **C**atalogs, **A**uto-assignment, **R**eviews Identity governance self-service loop: package the access, organise it in a catalog, optionally auto-assign it, and recertify it later with access reviews. Section 4 / Contrast Memory ## Versus Arena Side-by-side comparisons to sharpen your understanding of similar concepts. vs Conditional AccessvsIdentity Protection Risk Policies Click to compare #### Conditional Access vs Identity Protection | Aspect | Conditional Access | Identity Protection Risk Policies | | --- | --- | --- | | Role | General-purpose policy engine | Risk detection engine + feeds CA | | Inputs | User, app, device, location, client | Sign-in risk, user risk signals | | Configured in | Conditional Access blade | Risk policies inside Conditional Access | | License | Entra ID P1 | Entra ID P2 | | Typical action | Require MFA / compliant device | Require MFA or password change based on risk level | | Remediation | N/A -policy just gates access | Self-remediation via SSPR/MFA or admin dismissal | Click to flip back vs PIM (Entra Roles)vsPrivileged Access Groups Click to compare #### PIM for Roles vs PIM for Groups | Aspect | PIM (Entra Roles) | Privileged Access Groups | | --- | --- | --- | | Governs | Built-in Entra directory roles | Membership/ownership of a specific group | | Use case | Global Admin, User Admin, etc. | Custom bundles of app + Azure RBAC access tied to a group | | Activation | Time-bound role activation | Time-bound group membership or ownership activation | | Flexibility | Fixed set of built-in roles | Any permission the group itself grants | | Approval/MFA | Supported on activation | Supported on activation | | Also called | PIM for Microsoft Entra roles | PIM for Groups | Click to flip back vs Workload IdentitiesvsUser Identities Click to compare #### Workload Identities vs User Identities | Aspect | Workload Identities | User Identities | | --- | --- | --- | | Represents | App, service, or automated process | A human (member or guest) | | Object type | Service principal / app registration | User object | | Credentials | Certificate, secret, or federated credential | Password + MFA methods | | Sign-in experience | No interactive sign-in | Interactive sign-in with MFA/CA | | Governance tool | Workload ID Premium, federated credentials | PIM, access reviews, Conditional Access | | Ideal credential | Managed identity (no secret at all) | Passwordless (FIDO2/Authenticator) | Click to flip back vs Entra Connect (Sync)vsEntra Connect Cloud Sync Click to compare #### Entra Connect vs Cloud Sync | Aspect | Entra Connect (Sync) | Entra Connect Cloud Sync | | --- | --- | --- | | Architecture | Full sync engine, on-prem server | Lightweight provisioning agents | | Multi-forest | Supported but more complex to configure | Native support, simpler setup | | Management | Managed on the sync server | Managed entirely from the Entra portal | | Custom sync rules | Extensive rule customisation | Limited attribute mapping customisation | | High availability | Requires staging server | Multiple agents provide built-in redundancy | | Best for | Complex, single/few-forest topologies | Simple topologies, multiple forests, fast deployment | Click to flip back vs Entitlement ManagementvsAccess Reviews Click to compare #### Entitlement Management vs Access Reviews | Aspect | Entitlement Management | Access Reviews | | --- | --- | --- | | Purpose | Grant access -self-service requests | Recertify access -"do they still need it?" | | Trigger | User requests an access package | Scheduled recurrence or one-off review | | Scope | Apps, groups, Teams bundled together | Group/app membership, guests, or Entra roles | | Can stand alone | Yes -independent feature | Yes, but often paired with entitlement management | | Outcome | Access granted (with expiry option) | Access confirmed, or removed automatically | | License | Entra ID Governance / P2 | Entra ID Governance / P2 | Click to flip back Section 5 / Grouping Memory ## Cheat Sheet Organised reference grouped by exam domain — everything you need on one page. ### Implement and manage user identities ~25% #### Users & Groups - Member vs Guest -guests get restricted default permissions - Dynamic groups: rule-based membership via attribute expressions - Group-based licensing assigns SKUs automatically - Administrative units scope delegated administration - Bulk operations via CSV: create, invite, delete #### External Identities - B2B collaboration: guest signs in with home identity - Self-service sign-up: user flow for guest self-registration - B2B direct connect: mutual two-way trust (Teams Shared Channels) - Cross-tenant access settings: per-partner inbound/outbound trust - Entra External ID: CIAM platform for customer-facing apps #### Hybrid Identity - Entra Connect Sync: full sync engine, complex rule support - Entra Connect Cloud Sync: lightweight agents, multi-forest, cloud-managed - PHS: syncs hash of password hash -lowest maintenance - PTA: real-time validation against on-prem AD via agents - Federation (AD FS): auth delegated entirely to on-prem IdP - Staged rollout: pilot cloud auth changes before full cutover ### Implement authentication and access management ~25% #### Authentication Methods - Authentication methods policy: converged MFA + SSPR management - Passwordless: Windows Hello for Business, FIDO2, Authenticator - Temporary Access Pass: time-limited bootstrap credential - Certificate-based authentication: smart card / client cert sign-in - SSPR + password writeback resets the on-prem password too #### Conditional Access - Signals: user, app, device, location, client app, sign-in risk - Grant controls: MFA, compliant device, hybrid joined, approved app - Session controls: sign-in frequency, persistent browser, App Control - Report-only mode: test impact before enforcing - Named locations drive location-based conditions #### Identity Protection - Sign-in risk: per-session (anonymous IP, atypical travel) - User risk: persists until remediated (leaked credentials) - Risk levels: low, medium, high -each can drive a CA policy - Remediation: SSPR (user risk) or MFA (sign-in risk) - Requires Entra ID P2 #### SSO & App Integration - App registration = identity definition; Enterprise app = tenant instance - SSO protocols: SAML 2.0, OIDC/OAuth 2.0, password-based, linked - SCIM: automated provisioning/deprovisioning to SaaS apps - Application Proxy: publish on-prem apps without a VPN - Consent framework: user consent, admin consent, consent policies ### Plan and implement workload identities ~25% #### Service Principals & Managed Identities - Service principal = local representation of an app in the tenant - System-assigned managed identity: tied to one resource’s lifecycle - User-assigned managed identity: standalone, shareable across resources - Managed identities remove the need for stored credentials - Multi-tenant vs single-tenant app registrations #### Workload Identity Federation - Federated credentials exchange an external OIDC token for an Entra token - No secret stored on either side of the trust - Exam scenario: GitHub Actions OIDC deploying to Azure - Trust scoped by issuer, subject, and audience claims - Workload ID Premium: Conditional Access + risk detection for service principals ### Plan and implement identity governance ~25% #### Privileged Identity Management - Eligible = inactive until activated; Active = always on - Activation requirements: MFA, justification, ticket, approval - Time-bound assignments with start/end dates - PIM for Groups: JIT for group membership/ownership - Recurring access reviews recertify eligible role holders #### Entitlement Management - Access packages bundle apps, groups, and Teams - Catalogs group resources; connected orgs extend to partners - Auto-assignment policies grant by attribute, no request needed - Policies can require approval and set access expiry #### Access Reviews - Targets: group/app membership, guest access, Entra roles - Reviewers: self, resource owner, manager, or designated group - Auto-apply results on completion or non-response - Recurring cadence for ongoing recertification #### Lifecycle Workflows - Automates joiner-mover-leaver (JML) using built-in templates - Triggers: attribute-based (e.g. employeeHireDate) or time-based - Tasks: welcome email, group add, TAP, licence removal, disable account - Custom task extensions call Azure Logic Apps - Complements entitlement management -HR-driven vs self-service Section 6 / Method of Loci ## The Memory Palace Walk through themed rooms — each object anchors a concept in spatial memory. ### The Directory Hall User Identities -Where people and partners are recorded 👤 Member & Guest Users Members are internal; guests are external and start with restricted permissions 👥 Dynamic Groups Membership rules recalculate automatically as attributes change 🌐 B2B Collaboration Guests invited to sign in with their own home identity 🤝 B2B Direct Connect Two-way mutual trust -partner users feel like insiders (Teams Shared Channels) 🔗 Entra Connect / Cloud Sync The bridge from on-prem AD DS -PHS, PTA, or federation for authentication ### The Checkpoint Corridor Authentication & Access -Where every sign-in is challenged 🔐 Passwordless Methods Windows Hello for Business, FIDO2 keys, Authenticator passwordless sign-in 🎫 Temporary Access Pass Bootstraps a new user into passwordless before they’ve registered anything 🚦 Conditional Access Policy Signals in, grant/session controls out -tested first in report-only mode ⚠️ Risk-Based Policies Sign-in risk (per-session) and user risk (persistent) drive automatic responses 🔑 SSO via Enterprise Apps SAML/OIDC tokens hand off trust to downstream apps; SCIM keeps them in sync ### The Machine Room Workload Identities -Where non-human callers live ⚙️ Service Principal Local representation of an app -what actually gets assigned permissions 🤖 System-Assigned Managed Identity Lives and dies with its resource -no separate lifecycle to manage 🔗 User-Assigned Managed Identity Standalone identity shared across multiple resources 🤝 Federated Credential Trades an external OIDC token (e.g. GitHub Actions) for an Entra token -zero secrets 🛡️ Workload ID Premium Extends Conditional Access and risk detection to service principals ### The Governance Vault Identity Governance -Where privileged and time-bound access is controlled ⏱️ PIM Eligible Assignment Role stays off until activated -with MFA, justification, or approval 👥 PIM for Groups Just-in-time activation extended to sensitive group membership 📦 Access Package One request bundles apps, groups, and Teams behind an approval policy 🔍 Access Review Recurring recertification -auto-removes access on denial or non-response 🔄 Lifecycle Workflow HR-triggered joiner-mover-leaver automation -from welcome email to account disable Section 7 / Pattern Recognition ## Pattern Spotter Decision trees and trigger-answer pairs — see the pattern, know the answer. Which Hybrid Authentication Method? Which Hybrid Authentication Method?   ├── Want lowest maintenance, no on-prem servers exposed? → Password Hash Sync (PHS) -with leaked credential detection  ├── Password policy must be enforced live against on-prem AD? → Pass-through Authentication (PTA) via lightweight agents  ├── Regulatory or smart-card requirement mandates on-prem control? → Federation with AD FS -authentication never touches Entra directly  └── Need to test a change before rolling out tenant-wide? → Staged rollout to a pilot group first Conditional Access or Identity Protection? Conditional Access or Identity Protection?   ├── Blocking legacy authentication for everyone? → Conditional Access policy -client app condition + block control  ├── Requiring MFA only when sign-in risk is medium or high? → Identity Protection sign-in risk policy (via Conditional Access)  ├── Forcing a password change when an account is likely compromised? → Identity Protection user risk policy requiring secure password change  └── Requiring a compliant device for finance apps only? → Conditional Access policy scoped to that app with device compliance control Which Workload Identity Approach? Which Workload Identity Approach?   ├── Azure resource needs to call another Azure service? → Managed identity (system-assigned if 1:1, user-assigned if shared)  ├── External CI/CD pipeline needs to deploy to Azure? → Workload identity federation -federated credential, no stored secret  ├── Third-party SaaS app needs to be granted API permissions? → App registration + service principal with scoped API permissions  └── Need Conditional Access enforcement on a service principal itself? → Entra Workload ID Premium Which Governance Tool? Which Governance Tool?   ├── User needs occasional Global Administrator access? → PIM eligible assignment with MFA + approval on activation  ├── New project team needs a bundle of apps and groups fast? → Entitlement management access package, self-service request  ├── Need to periodically confirm guests still need access? → Recurring access review targeting guest membership  └── New hire needs accounts and groups ready on day one? → Lifecycle Workflow triggered by employeeHireDate ## Decision Cards "exchange a hash of the password hash"→Password Hash Sync (PHS) "real-time validation against on-prem AD, agents required"→Pass-through Authentication (PTA) "time-limited passcode to bootstrap a new user into passwordless"→Temporary Access Pass (TAP) "mutual two-way trust, feels like an internal user, Teams Shared Channels"→B2B direct connect "per-session risk from an anonymous IP or atypical travel"→Sign-in risk (Identity Protection) "risk that persists until the user changes their password"→User risk (Identity Protection) "eliminate stored credentials for an Azure resource calling another service"→Managed identity (system- or user-assigned) "GitHub Actions deploys to Azure with no stored secret"→Workload identity federation / federated credential "role is off until activated, requires MFA and approval"→PIM eligible assignment "self-service bundle of apps, groups, and Teams behind one approval"→Entitlement management access package Ready to certify? ## Train with practitioners, not presenters Lucid Labs delivers Microsoft certification training led by Microsoft Certified Trainers (MCTs) and grounded in real-world project experience. We adapt every session to your team's environment, data stack, and business objectives — because the best exam prep comes from engineers who build these solutions every day. 🔐 Zero Trust Identity Design Hands-on labs building Conditional Access and Identity Protection risk policies aligned to Zero Trust principles in your own tenant. 🔗 Hybrid Identity Deep Dive Work through Entra Connect vs Cloud Sync trade-offs, authentication method selection, and staged rollout planning for real migrations. ⏱️ Privileged Access Governance Configure PIM, entitlement management, access reviews, and Lifecycle Workflows to eliminate standing privileged access. 🤖 Workload Identity Security Replace stored secrets with managed identities and workload identity federation across your CI/CD and Azure estate. [Talk to us about SC-300: Identity and Access Administrator training](https://lucidlabs.com.au/?service=training-consulting&message=I%27m%20interested%20in%20SC-300%20identity%20and%20access%20administration%20training%20for%20my%20team.#contact) Custom training for teams & individuals — remote or on-site across Australia ![Keith Oak](https://lucidlabs.com.au/team/koak-400.jpg) Keith Oak Chief Technology Officer — Lucid Labs Microsoft Solutions Partner architect specialising in Fabric, Azure Data & AI, and GitHub Enterprise. 18+ years delivering data platforms for Australian businesses — building the systems these exams test every day. [LinkedIn ↗](https://www.linkedin.com/in/keithoak/)[lucidlabs.com.au ↗](https://lucidlabs.com.au/)Published 29-03-2026