Microsoft Identity and Access Administrator (SC-300) Exam Blueprint

SC-300

Microsoft

700 (1-1000)Passing Score

Practice Microsoft Identity and Access Administrator on QuizForge

Credential type: certification examination · verified on the issuer's site September 20, 2026 issuer page

Exam Domains

1.0 Implement and manage user identities 20-25%

1.1Configure and manage a Microsoft Entra tenant
Configure and manage built-in and custom Microsoft Entra roles; Recommend when to use administrative units; Configure and manage administrative units; Evaluate effective permissions for Microsoft Entra roles; Configure and manage domains in Microsoft Entra ID and Microsoft 365; Configure Company branding settings; Configure tenant properties, user settings, group settings, and device settings
1.2Create, configure, and manage Microsoft Entra identities
Create, configure, and manage users; Create, configure, and manage groups; Manage custom security attributes; Automate bulk operations by using the Microsoft Entra admin center and PowerShell; Manage device join and device registration in Microsoft Entra ID; Assign, modify, and report on licenses
1.3Implement and manage identities for external users and tenants
Manage External collaboration settings in Microsoft Entra ID; Invite external users, individually or in bulk; Manage external user accounts in Microsoft Entra ID; Implement Cross-tenant access settings; Implement and manage cross-tenant synchronization; Configure external identity providers, including protocols such as SAML and WS-Fed
1.4Implement and manage hybrid identity
Implement and manage Microsoft Entra Connect Sync; Implement and manage Microsoft Entra Cloud Sync; Implement and manage password hash synchronization; Implement and manage pass-through authentication; Implement and manage seamless single sign-on (SSO); Migrate from AD FS to other authentication and authorization mechanisms; Implement and manage Microsoft Entra Connect Health

2.0 Implement authentication and access management 20-25%

2.1Plan, implement, and manage Microsoft Entra user authentication
Plan for authentication; Implement and manage authentication methods, including certificate-based authentication, Temporary Access Pass, OAuth 2.0 tokens, Microsoft Authenticator, and passkeys (FIDO2); Implement and manage tenant-wide multifactor authentication (MFA) settings; Configure and deploy self-service password reset (SSPR); Implement and manage Windows Hello for Business; Disable accounts and revoke user sessions; Implement and manage Microsoft Entra password protection; Enable Microsoft Entra Kerberos authentication for hybrid identities
2.2Plan, implement, and manage Microsoft Entra Conditional Access
Plan Conditional Access policies; Implement Conditional Access policy assignments; Implement Conditional Access policy controls; Test and troubleshoot Conditional Access policies; Implement session management; Implement device-enforced restrictions; Implement continuous access evaluation; Configure authentication context; Implement protected actions; Create a Conditional Access policy from a template
2.3Manage risk by using Microsoft Entra ID Protection
Implement and manage user risk by using Microsoft Entra ID Protection or Conditional Access policies; Implement and manage sign-in risk by using Microsoft Entra ID Protection or Conditional Access policies; Implement and manage multifactor authentication registration by using authentication methods and registration campaigns; Monitor, investigate and remediate risky users and risky sign-ins; Monitor, investigate, and remediate risky workload identities
2.4Implement Global Secure Access
Deploy Global Secure Access clients; Deploy and manage Private Access; Deploy and manage Internet Access; Deploy and manage Internet Access for Microsoft 365

3.0 Plan and implement workload identities 20-25%

3.1Plan and implement identities for applications and Azure workloads
Select appropriate identities for applications and Azure workloads, including managed identities, service principals, user accounts, and managed service accounts; Create managed identities; Assign a managed identity to an Azure resource; Use a managed identity assigned to an Azure resource to access other Azure resources
3.2Plan, implement, and monitor the integration of enterprise applications
Plan and implement settings for enterprise applications, including application-level and tenant-level settings; Assign appropriate Microsoft Entra roles to users to manage enterprise applications; Design and implement integration for on-premises apps by using Microsoft Entra Application Proxy; Design and implement integration for software as a service (SaaS) apps; Assign, classify, and manage users, groups, and app roles for enterprise applications; Configure and manage user and admin consent; Create and manage application collections
3.3Plan and implement app registrations
Plan for app registrations; Create app registrations; Configure app authentication; Configure API permissions; Create app roles
3.4Manage and monitor app access by using Microsoft Defender for Cloud Apps
Configure and analyze cloud discovery results by using Defender for Cloud Apps; Configure connected apps; Implement application-enforced restrictions; Configure Conditional Access app control; Create access and session policies in Defender for Cloud Apps; Implement and manage policies for OAuth apps; Manage the Cloud app catalog

4.0 Plan and automate identity governance 20-25%

4.1Plan and implement entitlement management in Microsoft Entra
Plan entitlements; Create and configure catalogs; Create and configure access packages; Manage access requests; Implement and manage terms of use (ToU); Manage the lifecycle of external users; Configure and manage connected organizations
4.2Plan, implement, and manage access reviews in Microsoft Entra
Plan for access reviews; Create and configure access reviews; Monitor access review activity; Manually respond to access review activity
4.3Plan and implement privileged access
Plan and manage Microsoft Entra roles in Microsoft Entra Privileged Identity Management (PIM), including settings and assignments; Plan and manage Azure resources in PIM, including settings and assignments; Plan and configure PIM for Groups; Manage the PIM request and approval process; Analyze PIM audit history and reports; Create and manage break-glass accounts
4.4Monitor identity activity by using logs, workbooks, and reports
Review and analyze sign-in, audit, and provisioning logs by using the Microsoft Entra admin center; Configure diagnostic settings, including configuring destinations such as Log Analytics workspaces, storage accounts, and Azure Event Hubs; Monitor Microsoft Entra ID by using KQL queries in Log Analytics; Analyze Microsoft Entra ID by using workbooks and reporting; Monitor and improve the security posture by using Identity Secure Score

Exam Details

Online ProctoringAvailable

RenewalRequired -- Microsoft certifications (Associate/Expert/Specialty) are renewed annually for free via a short renewal assessment on Microsoft Learn. Renewal assessment available 6 months before expiry. Fundamentals certifications do not expire.

Retake PolicyAfter the first failure, wait 24 hours. Wait 14 days between later attempts. At most five attempts in the 12 months starting with the first attempt; after five failures, wait until that period ends. Retake fees apply. See Microsoft's policy for exceptions.

Official Study Resources

official documentationChoose from self-paced learning paths and modules or take an instructor-led course

official documentationMicrosoft Entra ID documentation

official documentationAzure Identity Management and access control security best practices

official documentationMicrosoft Entra External Identities documentation

official documentationAzure AD Multi-Factor Authentication overview

official documentationMicrosoft Defender for Cloud documentation

official documentationWhat is Microsoft Entra ID Governance?

official documentationWhat is Privileged Identity Management?

official documentationWhat is Azure Active Directory monitoring and health?

official documentationMicrosoft security documentation

official documentationMicrosoft Q&A | Microsoft Docs

official documentationExam Readiness Zone

official documentationBrowse other Microsoft Learn shows

Source review and study planning

Source checked 2026-09-04. Objectives effective 2026-04-27.

Official-source reconciliation with automated hierarchy checks; not an endorsement by Microsoft.

Reconciled domain ranges and objective hierarchy against the dated official guide; local objective numbers are navigation aids.
Corrected first and subsequent retake waiting periods; removed the unsupported score threshold.
Removed unsupported fixed question count, duration, price, language list and testing rules. Consult the official exam page for booking details; the audience profile describes recommended experience, not mandatory prerequisites.

Official objectives | Official retake policy

Plan against this version

Check the official revision history before planning study: Compare the effective date with your exam language and appointment. Use changed objectives to revisit earlier preparation.
Use the guide's learning and documentation map: For each objective, record a task you can perform and the official reference used. Prioritize gaps; the published ranges are not predicted question counts.
Atlas study exercise: Review an identity lifecycle: Follow a user from joining an organization through a role change and departure. Identify authentication, authorization and access-review decisions at each step. Explain how you would check that access is appropriate, then map the scenario to identity governance objectives. This is a study aid, not an official exam question or a prediction of your result.