Study Guide: SC-300 - Microsoft Identity and Access Administrator
The introduction of the more security-focused exams from Microsoft, itโs given me an opportunity to start looking at a couple of areas that have piqued my curiosity. One of these has been the identity and access management arena, where the SC-300 exam sits very neatly in this area. The SC-300 exam enables you to earn the Microsoft Certified: Identity and Access Administrator Associate badge, giving you the ability to demonstrate that you are able to design, implement, and operate an organizationโs identity and access management systems by using Azure AD. As well as troubleshooting, monitoring, and reporting for the identity and access environment.
With any Microsoft Exam the content changes on a regular basis, so it is always best to ensure you keep updated with the latest guidance from Microsoft. This can usually be found on the Exam page. In terms of the SC-300 exam the skills measured are broken down into the following categories and weighted as such:
- Implement an identity management solution (25-30%)
- Implement an authentication and access management solution (25-30%)
- Implement access management for apps (10-15%)
- Plan and implement an identity governance strategy (25-30%)
Itโs worth noting that by default, most of the questions cover features that are General Availability (GA), however, the exam may contain questions on Preview features if those features are commonly used.
Microsoft Learn Resources
By default, I always try to use the Microsoft Learn resources. If you arenโt aware of Microsoft Learn, it is a training platform built and maintained by Microsoft and is completely free of charge. Microsoft Learn provides a vast amount of online training and learning paths for a range of Microsoft technologies, the training is delivered through videos, reading materials, and labs, but also has quizzes at the end of sections, so that you can gauge your knowledge. By default, my first point is always to check the Microsoft Learn materials.
- SC-300 part 1: Implement an identity management solution (4 Modules)
- SC-300 part 2: Implement an Authentication and Access Management solution (4 Modules)
- SC-300 part 3: Implement Access Management for Apps (3 Modules)
- SC-300 part 4: Plan and implement an identity governance strategy (4 Modules)
Microsoft Docs Resources
On top of the Microsoft Learn resources, is Microsoft Docs, again this is another free Microsoft Resource. I have taken the list of categories for the SC-300 exam and looked for the relevant resources for each subitem. These are all listed in the Skill Measured Document on the exam page. Some of these links may get broken over time, so please let me know if you come across any and I will look to update this post.
Implement an identity management solution (25-30%)
Implement initial configuration of Azure Active Directory
- Configure and manage Azure AD directory roles
- Configure and manage custom domains
- Configure and manage device registration options
- Configure delegation by using administrative units
- Configure tenant-wide settings
Create, configure, and manage identities
- Create, configure, and manage users
- Create, configure, and manage groups
- Manage licenses
Implement and manage external identities
- Manage external collaboration settings in Azure Active Directory
- Invite external users (individually or in bulk)
- Manage external user accounts in Azure Active Directory
- Configure identity providers (social and SAML/WS-fed)
Implement and manage hybrid identity
- Implement and manage Azure Active Directory Connect (AADC)
- Implement and manage Password Hash Synchronization (PHS)
- Implement and manage Pass-Through Authentication (PTA)
- Implement and manage seamless Single Sign-On (SSO)
- Implement and manage Federation excluding manual ADFS deployments
- Implement and manage Azure Active Directory Connect Health
- Troubleshoot synchronization errors
Implement an authentication and access management solution (25-30%)
Plan and implement Azure Multifactor Authentication (MFA)
- Plan Azure MFA deployment (excluding MFA Server)
- Implement and manage Azure MFA settings
- Manage MFA settings for users
Manage user authentication
- Administer authentication methods (FIDO2 / Passwordless)
- Implement an authentication solution based on Windows Hello for Business
- Configure and deploy self-service password reset
- Deploy and manage password protection
- Implement and manage tenant restrictions
Plan, implement, and administer conditional access
- Plan and implement security defaults
- Plan conditional access policies
- Implement conditional access policy controls and assignments (targeting, applications and conditions)
- Testing and troubleshooting conditional access policies
- Implement application controls
- Implement session management
- Configure smart lockout thresholds
Manage Azure AD Identity Protection
- Implement and manage a user risk policy
- Implement and manage sign-in risk policies
- Implement and manage MFA registration policy
- Monitor, investigate and remediate elevated risky users
Implement Access Management for Apps (10-15%)
Plan, implement, and monitor the integration of Enterprise Apps for Single Sign-On (SSO)
- Implement and configure consent settings
- Discover apps by using MCAS or ADFS app report
- Design and implement access management for apps
- Design and implement app management roles
- Monitor and audit access / Sign-Ons to Azure Active Directory integrated enterprise applications
- Integrate on-premises apps by using Azure AD application proxy
- Integrate custom SaaS apps for SSO
- Configure pre-integrated (gallery) SaaS apps
- Implement application user provisioning
Implement app registrations
- Plan your line of business application registration strategy
- Implement application registrations
- Configure application permissions
- Implement application authorization
- Plan and configure multi-tier application permissions
Plan and implement an Identity Governance Strategy (25-30%)
Plan and implement entitlement management
- Define catalogs
- Define access packages
- As above
- Plan, implement and manage entitlements
- Implement and manage terms of use
- Manage the lifecycle of external users in Azure AD Identity Governance settings
Plan, implement, and manage access reviews
- Plan for access reviews
- Plan an Azure Active Directory Access Reviews deployment
- What are access reviews? - Azure Active Directory
- These two articles cover most of the below topics listed.
- Create access reviews for groups and apps
- Monitor access review findings
- Manage licenses for access reviews
- Automate access review management tasks
- Configure recurring access review
Plan and implement privileged access
- The following article covers all the below PIM Topics:
- Define a privileged access strategy for administrative users (resources, roles, approvals, thresholds)
- Configure Privileged Identity Management for Azure AD roles
- Configure Privileged Identity Management for Azure resources
- Assign roles
- Manage PIM requests
- Analyze PIM audit history and reports
- Create and manage break-glass accounts
Monitor and maintain Azure Active Directory
- Analyse and investigate sign-in logs to troubleshoot access issues
- Review and monitor Azure AD audit logs
- Enable and integrate Azure AD diagnostic logs with Log Analytics / Azure Sentinel
- Export sign-in and audit logs to a third-party SIEM
- Review Azure AD activity by using Log Analytics / Azure Sentinel, excluding KQL use
- Analyse Azure Active Directory workbooks / reporting
- Configure notifications
SC-300 Tips and other resources
On top of these Microsoft resources, I always recommend trying to get some actual time with the toolsets if possible. This can be difficult to do unless you have a test Microsoft 365 subscription, so sometimes itโs worth discussing with your manager or even a colleague about building a test environment.
Other resources to check out include Azure forums, Microsoft Learn Blog, Channel 9, Tuesdays With Corey, Azure Friday, and Azure Blog and Updates. On top of these some great content from various community sources on Youtube, with one of my favourite channels being John Savillโs.
All the best and good luck on your journey to passing SC-300 and gaining your Identity and Access Administrator Associate badge. If you have any further links and resources then please let me know in the comments and I can add them to this blog.
Please check out my other Study Guide Blogs for AZ-104, AZ-500, and MS-500.