All certifications / SC-300 / Lessons
SC-300 SC-300 (skills outline of April 27, 2026) lessons
Study SC-300 for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the SC-300 study planA week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Domain 1: Implement and manage user identities
- Tenant setup: custom domain names and DNS verification, company branding, tenant properties and user settings
- Microsoft Entra built-in roles, custom roles and least-privilege role assignment
- Administrative units, including restricted management administrative units, to scope admin roles
- Users and groups: security vs Microsoft 365 groups, assigned vs dynamic membership rules, bulk operations
- Licenses: direct vs group-based licensing and resolving license assignment errors
- Devices: Microsoft Entra registered, Microsoft Entra joined and Microsoft Entra hybrid joined; device settings
- External identities: B2B collaboration, guest invitations and redemption, external collaboration settings
- Cross-tenant access settings (inbound/outbound, trust settings), B2B direct connect and cross-tenant synchronization
- Hybrid identity: Microsoft Entra Connect Sync vs Microsoft Entra Cloud Sync, filtering and sync scheduling
- Sign-in methods for hybrid users: password hash sync, pass-through authentication, federation, Seamless SSO, staged rollout
- Monitoring sync health with Microsoft Entra Connect Health and troubleshooting sync errors
Domain 2: Implement authentication and access management
- Authentication methods policy: Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, certificate-based authentication, Temporary Access Pass, SMS/voice
- Registration campaigns, combined security info registration and system-preferred MFA
- Self-service password reset (SSPR): methods, registration, and password writeback for hybrid users
- Microsoft Entra Password Protection: global and custom banned password lists, smart lockout, on-premises DC agent and proxy
- Security defaults vs Conditional Access, and emergency access (break-glass) accounts
- Conditional Access: assignments, conditions (locations, device platforms, client apps, filters for devices, risk), grant and session controls
- Named locations, authentication strengths, sign-in frequency, persistent browser session and token protection
- Testing policies with report-only mode and the What If tool; troubleshooting with sign-in logs
- Microsoft Entra ID Protection: user risk vs sign-in risk, risk detections, remediation and risk-based Conditional Access
- Continuous access evaluation (CAE) and session revocation
- Global Secure Access: Microsoft Entra Internet Access and Private Access, traffic forwarding profiles
Domain 3: Plan and implement workload identities
- Managed identities: system-assigned vs user-assigned, and assigning them Azure RBAC roles
- Service principals and app registrations: application objects, client secrets vs certificates vs federated credentials
- API permissions: delegated vs application permissions, user consent settings, admin consent and the admin consent workflow
- App roles, the roles claim, and 'Assignment required' on enterprise applications
- Enterprise application single sign-on: SAML (Identifier, Reply URL, signing certificate) and OpenID Connect
- Automatic user provisioning to SaaS apps with SCIM, scoping filters and provisioning logs
- Microsoft Entra application proxy and private network connectors for on-premises web apps
- Microsoft Defender for Cloud Apps: cloud discovery, app governance and Conditional Access app control session policies
- Monitoring and securing workload identities: Workload ID Premium, risky workload identities, Conditional Access for workload identities
- Reviewing and removing unused or over-permissioned applications and expiring credentials
Domain 4: Plan and automate identity governance
- Entitlement management: catalogs, access packages, assignment policies, approvals, expiration and separation of duties
- Connected organizations and access packages for external users
- Access reviews: groups, apps, access packages and Entra roles; reviewers, recurrence, auto-apply and inactive-user recommendations
- Lifecycle workflows for joiner, mover and leaver tasks (employeeHireDate, employeeLeaveDateTime)
- Terms of use and Conditional Access
- Privileged Identity Management (PIM): eligible vs active assignments, activation settings, approval, alerts
- PIM for Groups and PIM for Azure resource roles
- Sign-in, audit and provisioning logs; default retention and diagnostic settings to Log Analytics, storage or Event Hubs
- Workbooks, KQL queries in Log Analytics, Identity Secure Score and Microsoft Entra recommendations
- Licensing: Microsoft Entra ID P1, P2 and Microsoft Entra ID Governance features