Microsoft Identity and Access Administrator practice questions

1. Question 1 of 25

   You have an Azure Active Directory (Azure AD) tenant that contains the following objects: ✑ A device named Device1 ✑ Users named User1, User2, User3, User4, and User5 ✑ Groups named Group1, Group2, Group3, Group4, and Group5 The groups are configured as shown in the following table.

   

   To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

   • AGroup1 and Group4 only
   • BGroup1, Group2, Group3, Group4, and Group5
   • CGroup1 and Group2 only
   • DGroup1 only
   • EGroup1, Group2, Group4, and Group5 only

   Show answer

   Correct answer: B

   How others answered

   • B51%
   • E27%
   • C20%

   Only 51% agreed on this answer — treat it as contested rather than settled.

   Explanation

   There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

   Adapted from community discussion by sezza_blunt · 2021-06-12 · 93 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. S

      sezza_blunt

      2021-06-12

      93 upvotes

      There is not enough information in the question to provide a 100% correct answer. You can assign licences to any group created within the Azure AD portal. These can include security groups, Microsoft 365 groups, and either assigned or dynamic groups. You can even create a dynamic device security group and assign E5 licences to it, which doesn't make sense but is true (I've tested it). However, the missing bit of information is whether the Microsoft 365 groups have the "SecurityEnabled" attribute set to True. Only M365 groups that have the "SecurityEnabled" attribute set to True can have licences assigned to them. If the group is created in the M365 Admin Centre, then the "SecurityEnabled" attribute is set to False and you can not assign licences to the group. But if the M365 group is created in the Azure AD portal, then the "SecurityEnabled" attribute is set to True and you can assign licences. For the answer, I would make an assumption that because this is an Identity-related exam testing us on Azure AD topics, that the M365 groups were created in the Azure AD portal and therefore have the "SecurityEnabled" attribute set to True. Which means the correct answer is B - all groups.

   2. H

      HarishArul

      2022-12-26

      21 upvotes

      No C is the right answer. You can assign licenses only to the Security Group, not Microsoft 365 Group. And Group 3 consists of a Device, not users. Only users can have a license, not a device. Microsoft 365 Group is basically used for shared mailboxes, which will only be possible if you already have a license. So Group 1 and Group 2 only can be assigned licenses.

   3. B

      Beitran

      2021-05-01

      21 upvotes

      Wrong, you can assign licenses to Microsoft 365 groups as well. The correct answer is E

   4. J

      jack987

      2022-12-27

      12 upvotes

      You're right. I just tested it in our environment. The license option won't show for Microsoft 365 Groups. The correct answer is C. Use group-based licensing with dynamic groups You can use group-based licensing with any security group, which means it can be combined with Azure AD dynamic groups. https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced

2. Question 2 of 25

   Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect. You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync. What should you do in Azure AD Connect?

   • ACreate an inbound synchronization rule for the Windows Azure Active Directory connector.
   • BConfigure a Full Import run profile.
   • CCreate an inbound synchronization rule for the Active Directory Domain Services connector.
   • DConfigure an Export run profile.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   Following https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#negative-filtering-do-not-sync-these. Answer C is correct. You create an inbound rule because information is taken from Active Directory to Metaverse object.

   Adapted from community discussion by palito1980 · 2023-04-10 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. P

      palito1980

      2023-04-10

      Selected C4 upvotes

      Following https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#negative-filtering-do-not-sync-these. Answer C is correct. You create an inbound rule because information is taken from Active Directory to Metaverse object.

   2. J

      jtlucas99

      2024-10-07

      4 upvotes

      signing in to the server running Microsoft Entra Connect Sync using an account that is a member of the ADSyncAdmins security group. Launch the Synchronization Rules Editor from the Start menu. In the editor, create an inbound synchronization rule to filter out (not synchronize) all users where extensionAttribute15 has the value NoSync. Apply the necessary filter conditions to exclude these users during synchronization 1.

   3. T

      tester18128075

      2022-04-19

      5 upvotes

      No, inside the tool, when you add connector, you choose Active Directory connector to choose domains

   4. H

      hwoarang

      2022-07-09

      Selected C4 upvotes

      the answer is correct and tricky question, they already said "What you configure in *Azure AD Connect*"

3. Question 3 of 25

   Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

   

   All the users work remotely. Azure AD Connect is configured in Azure AD as shown in the following exhibit.

   

   Connectivity from the on-premises domain to the internet is lost. Which users can sign in to Azure AD?

   • AUser1 and User3 only
   • BUser1 only
   • CUser1, User2, and User3
   • DUser1 and User2 only

   Show answer

   Correct answer: A

   How others answered

   • A75%
   • C25%

   Explanation

   I think the answer is correct. When the connection to on-premise is lost, PTA will not work anymore. The failover to Password Hash Synchronization is not automatic and needs to be configured manually in AD Connect. If the connection to on-premise is lost, and the AD Connect server runs un-premise, user 2 cannot login. -~~~~~- Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication.

   Adapted from community discussion by examkid · 2021-07-23 · 37 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. E

      examkid

      2021-07-23

      37 upvotes

      I think the answer is correct. When the connection to on-premise is lost, PTA will not work anymore. The failover to Password Hash Synchronization is not automatic and needs to be configured manually in AD Connect. If the connection to on-premise is lost, and the AD Connect server runs un-premise, user 2 cannot login. -~~~~~- Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication.

   2. A

      AmazingKies

      2021-09-16

      15 upvotes

      Pass-through authentication is configured, Sync user will try to authenticate on local AD and unable to authenticate due to internet outage only cloud users ( User 1 and User 3) can be authenticated Correct Answer : A

   3. R

      rachee

      2024-09-23

      6 upvotes

      C. Per https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations, Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. The diagram shows Pasword Hash Synchronization is enabled.

   4. F

      f2bf85a

      2024-09-23

      Selected A2 upvotes

      https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-current-limitations#unsupported-scenarios Read the Note: Enabling Password Hash Synchronization gives you the option to failover authentication if your on-premises infrastructure is disrupted. This failover from Pass-through Authentication to Password Hash Synchronization is not automatic. You'll need to switch the sign-in method manually using Azure AD Connect. If the server running Azure AD Connect goes down, you'll require help from Microsoft Support to turn off Pass-through Authentication. Since the Password Hash sync failover is not automatic, in this case the answer is A. User2 that is directory sync will need Pass-Through Authentication, which will be unavailable at that moment.

4. Question 4 of 25

   DRAG DROP - You have a Microsoft 365 E5 subscription that contains two users named User1 and User2. You need to ensure that User1 can create access reviews for groups, and that User2 can review the history report for all the completed access reviews. The solution must use the principle of least privilege. Which role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Read access review of a group or of an app Least privileged role = Security Reader Additional roles= Security Administrator User Administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#enterprise-applications

   Adapted from community discussion by klayytech · 2024-03-30 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. D

      doch

      2023-01-25

      29 upvotes

      User Admin Security Reader Ref: https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task

   2. B

      BRZSZCL

      2024-10-22

      4 upvotes

      To ensure the least privilege principle is followed for each user: User1 needs to create access reviews for groups. The appropriate role for this task is User Access Administrator because it allows users to create and manage access reviews in Azure AD. User2 needs to review the history report for all completed access reviews. The role required for this is Reports Reader, which allows viewing reports without granting the ability to create or manage the reviews themselves. Summary: User1: User Access Administrator User2: Reports Reader

   3. K

      klayytech

      2024-03-30

      5 upvotes

      Read access review of a group or of an app Least privileged role = Security Reader Additional roles= Security Administrator User Administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-by-task#enterprise-applications

   4. K

      klayytech

      2024-04-21

      5 upvotes

      https://learn.microsoft.com/en-us/entra/id-governance/deploy-access-reviews#who-will-create-and-manage-access-reviews Global Admin Global Reader security reader does not have permission to read the history for Azure resource roles

5. Question 5 of 25

   HOTSPOT - You have an Azure subscription. You need to create two custom roles named Role1 and Role2. The solution must meet the following requirements: • Users that are assigned Role1 can create or delete instances of Azure Container Apps. • Users that are assigned Role2 can enforce adaptive network hardening rules. Which resource provider permissions are required for each role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Role1: Microsoft.App (for containers) Role2: Microsoft.Security Microsoft.Security controls the Security Center (renamed Defender for Cloud) (https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers), which handles Adaptive Network Hardening (https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening#what-is-adaptive-network-hardening)

   Adapted from community discussion by ThotSlayer69 · 2023-01-24 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. D

      dejo

      2023-01-19

      31 upvotes

      I think it's: Role1: Microsoft.App https://learn.microsoft.com/en-us/azure/container-apps/quickstart-portal#prerequisites Role2: Microsoft.Security https://learn.microsoft.com/en-ie/rest/api/defenderforcloud/adaptive-network-hardenings/enforce?tabs=HTTP

   2. T

      ThotSlayer69

      2023-01-24

      11 upvotes

      Role1: Microsoft.App (for containers) Role2: Microsoft.Security Microsoft.Security controls the Security Center (renamed Defender for Cloud) (https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers), which handles Adaptive Network Hardening (https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-network-hardening#what-is-adaptive-network-hardening)

   3. B

      BRZSZCL

      2024-10-22

      2 upvotes

      To create custom roles that meet the specified requirements, you need to ensure the correct permissions are applied for each role. Role1: Create or delete instances of Azure Container Apps For Role1, users need permissions related to managing Azure Container Apps. The correct resource provider and permission are: Microsoft.App/containerApps/write: This permission allows users to create and delete Azure Container Apps instances. It provides the necessary capability for Role1. Role2: Enforce adaptive network hardening rules For Role2, users need permissions related to adaptive network hardening, which is part of Microsoft Defender for Cloud. The correct resource provider and permission are: Microsoft.Security/adaptiveNetworkHardenings/write: This permission allows users to enforce adaptive network hardening rules. It fits the requirement for Role2, providing users with the ability to manage these security rules. Summary: Role1: Microsoft.App/containerApps/write Role2: Microsoft.Security/adaptiveNetworkHardenings/write

   4. C

      ColdCut

      2024-11-06

      3 upvotes

      The correct answer is: Role1: Microsoft.App Role2: Microsoft.Security Explanation: Role1 requires permissions to create or delete instances of Azure Container Apps. The relevant resource provider for Azure Container Apps is Microsoft.App. This provider includes the necessary permissions to manage container app instances. Role2 needs to enforce adaptive network hardening rules, which are part of Azure Security Center's capabilities. The Microsoft.Security resource provider contains the permissions required to enforce adaptive network hardening and other security-related configurations. Resource Links: For more details on Azure resource providers and roles: Microsoft.App resource provider Microsoft.Security resource provider

6. Question 6 of 25

   You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users. From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to the users. You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort. What should you use?

   • Athe Identity Governance blade in the Azure Active Directory admin center
   • Bthe Set-AzureAdUser cmdlet
   • Cthe Licenses blade in the Azure Active Directory admin center
   • Dthe Set-WindowsProductKey cmdlet

   Show answer

   Correct answer: C

   How others answered

   • C82%
   • B18%

   Explanation

   The Set-MsolUserLicense cmdlet updates the license assignment for a user. This can include adding a new license, removing a license, updating the license options, or any combination of these actions. https://docs.microsoft.com/en-us/microsoft-365/enterprise/remove-licenses-from-user-accounts-with-microsoft-365-powershell?view=o365-worldwide

   Adapted from community discussion by Sh1rub10 · 2022-03-28 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. J

      Jt909

      2021-09-17

      41 upvotes

      In the exam the cmdlet was Set-MsolUserLicense, the right one!

   2. M

      melatocaroca

      2021-07-13

      8 upvotes

      Set-AzureAdUser cannot be used to assign license you must use Set-AzureAdUserLicense Adds or removes licenses for a Microsoft online service to the list of assigned licenses for a user.

   3. S

      Sh1rub10

      2022-03-28

      Selected C4 upvotes

      The Set-MsolUserLicense cmdlet updates the license assignment for a user. This can include adding a new license, removing a license, updating the license options, or any combination of these actions. https://docs.microsoft.com/en-us/microsoft-365/enterprise/remove-licenses-from-user-accounts-with-microsoft-365-powershell?view=o365-worldwide

   4. F

      Faheem2020

      2022-09-28

      4 upvotes

      To remove licenses from an existing user account, use the following syntax: Set-MgUserLicense -UserId " " -RemoveLicenses @(" ") -AddLicenses @{} "The Set-MsolUserLicense and New-MsolUser (-LicenseAssignment) cmdlets are scheduled to be retired. Please migrate your scripts to the Microsoft Graph SDK's Set-MgUserLicense cmdlet as described above" https://learn.microsoft.com/en-us/microsoft-365/enterprise/remove-licenses-from-user-accounts-with-microsoft-365-powershell?source=recommendations&view=o365-worldwide

7. Question 7 of 25

   HOTSPOT - You have a Microsoft Entra tenant that has a Microsoft Entra ID P2 service plan. The tenant contains the users shown in the following table.

   

   You have the Device settings shown in the following exhibit.

   

   User1 has the devices shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise. select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   NOTE: Additional local administrators on Microsoft Entra joined devices: This setting allows you to select the users who are granted local administrator rights on a device. These users are added to the Device Administrators role in Microsoft Entra ID. Global Administrators in Microsoft Entra ID and device owners are granted local administrator rights by default. This option is a premium edition capability available through products like Microsoft Entra ID P1 or P2 and Enterprise Mobility + Security. https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities

   Adapted from community discussion by penatuna · 2024-02-09 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. P

      penatuna

      2024-02-09

      14 upvotes

      2) YES Admin1 is a Cloud Device Administrator. You must be assigned one of the following roles to manage device settings: • Global Administrator • Cloud Device Administrator https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal#configure-device-settings 3) NO This only applies to Win 10/11 Entra JOINED devices. This device is only registered.

   2. P

      penatuna

      2024-02-09

      12 upvotes

      1) NO Maximum number of devices: This setting enables you to select the maximum number of Microsoft Entra joined or Microsoft Entra registered devices that a user can have in Microsoft Entra ID. If users reach this limit, they can't add more devices until one or more of the existing devices are removed. The default value is 50. You can increase the value up to 100. If you enter a value above 100, Microsoft Entra ID sets it to 100. You can also use Unlimited to enforce no limit other than existing quota limits. Note! The Maximum number of devices setting applies to devices that are either Microsoft Entra joined or Microsoft Entra registered. This setting doesn't apply to Microsoft Entra hybrid joined devices. https://learn.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal#configure-device-settings

   3. P

      penatuna

      2024-02-09

      9 upvotes

      NOTE: Additional local administrators on Microsoft Entra joined devices: This setting allows you to select the users who are granted local administrator rights on a device. These users are added to the Device Administrators role in Microsoft Entra ID. Global Administrators in Microsoft Entra ID and device owners are granted local administrator rights by default. This option is a premium edition capability available through products like Microsoft Entra ID P1 or P2 and Enterprise Mobility + Security. https://learn.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-azure-ad-register https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin#manage-administrator-privileges-using-microsoft-entra-groups-preview https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities

   4. E

      emartiy

      2024-03-28

      7 upvotes

      YES -1 device is joined 1 registered so user can still join 4 device to azure since count is 1/5 (join important, not register) NO - Cloud Device Asdmins has no privileged to perform this option. NO - Device is not azure joined. It is only registered. So, this option also not valid.

8. Question 8 of 25

   HOTSPOT - How should the access be setup to the on-premises applications? Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Box 1: Server2 - Incorrect: Not Server 1: If you've deployed Azure AD Password Protection Proxy, do not install Azure AD Application Proxy and Azure AD Password Protection Proxy together on the same machine. Azure AD Application Proxy and Azure AD Password Protection Proxy install different versions of the Azure AD Connect Agent Updater service. These different versions are incompatible when installed together on the same machine. Server1 runs the Azure AD application Proxy connector. To use Application Proxy, you need a Windows server running Windows Server 2012 R2 or later. You'll install the Application Proxy connector on the server. This connector server needs to connect to the Application Proxy services in Azure, and the on-premises applications that you plan to publish. Scenario: Requirements. Authentication Requirements include: Enforce MFA when accessing on-premises applications. Existing Environment. On-premises Environment The on-premises network contains the servers shown in the following table. Existing Environment. Identity Environment The network contains an Active Directory forest named litware.com that is linked to an Azure Active Directory (Azure AD) tenant named litware.com. Azure AD Connect uses pass-through authentication and has password hash synchronization disabled. Litware.com contains a user named User1 who oversees all application development. Box 2: DC1 - The Azure AD Password Protection proxy service is typically on a member server in your on-premises AD DS environment. Once installed, the Azure AD Password Protection proxy service communicates with Azure AD to maintain a copy of the global and customer banned password lists for your Azure AD tenant. Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application

   Adapted from community discussion by Mriji · 2023-05-08 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. M

      Mriji

      2023-05-08

      21 upvotes

      Correct answer is Server 2, then Azure AD. The password protection proxy is installed on a member server. You enable the banned p/w list in Azure AD, the proxy downloads it and passes it to the DCs in the domain.

   2. F

      Faheem2020

      2023-04-04

      10 upvotes

      Answer should be SERVER2 and Azure AD Configure the password list in Azure AD, the password protection proxy makes it available on you on prem DC, refer to the diagram in the link: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy

   3. H

      Hot_156

      2023-04-05

      8 upvotes

      Check this link, https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises Under "How Azure AD PP works" you will find this, The DC Agent service is responsible for initiating the download of a new password policy from Azure AD. The first step is to locate an Azure AD Password Protection Proxy service by querying the forest for proxy serviceConnectionPoint objects. and if you keep reading, you will find that there is no such thing as a password banned listed on-prem for modification. Everything is downloaded from Azure AD With that, I will stay with -Server2 -Azure AD

   4. D

      dobriv

      2023-10-04

      3 upvotes

      It is a SERVER 2 answer ! Here is written very clear : !! Warning !!! Azure AD Password Protection proxy and Azure AD Application Proxy install different versions of the Microsoft Azure AD Connect Agent Updater service, which is why the instructions refer to Application Proxy content. These different versions are incompatible when installed side by side and doing so will prevent the Agent Updater service from contacting Azure for software updates, so you should never install Azure AD Password Protection Proxy and Application Proxy on the same machine. https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy

9. Question 9 of 25

   You need to track application access assignments by using Identity Governance. The solution must meet the delegation requirements. What should you do first?

   • AModify the User consent settings for the enterprise applications.
   • BCreate a catalog.
   • CCreate a program.
   • DModify the Admin consent requests settings for the enterprise applications.

   Show answer

   Correct answer: C

   How others answered

   • C60%
   • B40%

   Only 60% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I am confused. Can somebody explain to me what a program is? Here is the root of the docs relating Identity Governance. Nothing in the next subpages come up with the search term 'Program'. Or creating a program. https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview Nothing here under Entitlement Management talks about a program either. https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview Nor is the word program come up here in setting up access reviews. https://learn.microsoft.com/en-us/azure/active-directory/governance/manage-access-review Norr here where it talks about access reviews https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

   Adapted from community discussion by DeepMoon · 2022-10-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

   1. Z

      zakyntos

      2021-09-08

      25 upvotes

      Should be C. Requirement is for program which is a part of Access Reviews. Catalog is for Access Packages

   2. M

      martonnie

      2023-10-05

      6 upvotes

      To track application access assignments by using Identity Governance in Microsoft Azure while meeting delegation requirements, you should start by creating a catalog. Therefore, option B, "Create a catalog," is the correct first step in this scenario. Creating a catalog is typically the first step in setting up Identity Governance to manage access to applications and resources. It allows you to define and organize your resources, including enterprise applications, and is a foundational element in the Identity Governance framework. Options A, C, and D do not directly address the initial setup of Identity Governance and tracking application access assignments, so they are not the first steps in this context.

   3. D

      DeepMoon

      2022-10-08

      4 upvotes

      I am confused. Can somebody explain to me what a program is? Here is the root of the docs relating Identity Governance. Nothing in the next subpages come up with the search term 'Program'. Or creating a program. https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview Nothing here under Entitlement Management talks about a program either. https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview Nor is the word program come up here in setting up access reviews. https://learn.microsoft.com/en-us/azure/active-directory/governance/manage-access-review Norr here where it talks about access reviews https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

   4. L

      Labelfree

      2024-11-15

      Selected C2 upvotes

      C. Program - It specifies to use this under the requirements in the text. Not sure why that's not mentioned more. Also, here's Why B. Create a catalog seems appealing (but is incorrect): A catalog in Azure AD is a way to organize and group resources like applications, groups, and role assignments. It can certainly be useful for managing resources and can serve as part of an Identity Governance strategy, particularly in Azure AD Entitlement Management. People may naturally associate a catalog with managing applications, so it makes sense that some would vote for it. However, the question specifically asks for tracking application access assignments with a focus on delegation requirements. To clarify, catalogs are typically used to organize resources for access packages or entitlement management. They provide a container for resources but don't directly govern access assignment or track it in the way that programs do.

10. Question 10 of 25

    HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains a group named Group3 and an administrative unit named Department1. Department1 has the users shown in the Users exhibit. (Click the Users tab.)

    

    Department1 has the groups shown in the Groups exhibit. (Click the Groups tab.)

    

    Department1 has the user administrator assignments shown in the Assignments exhibit. (Click the Assignments tab.)

    

    The members of Group2 are shown in the Group2 exhibit. (Click the Group2 tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Admin1 and Admin2 are not members of Administrative group(Department1).However Admin1 has User administrator role scope for Department1 and Admin2 has User administrator role scope for the whole directory User 1 And User 2 are users of Department1 Group1(No members) and Group2(User 3 and User4 are members) are groups of Department1. FIrst Answer - NO Admin1 cannot reset the pwd for User 3 and User4 because they are part of group2.(User admin role assigned to admin unit cannot reset pwd of users present inside the group. Admin1 can reset the pwd of User1 and User2 who are not part of any groups inside the admin unit) Second Answer : YES Admin1 can add/remove users to the GROUPS present inside the admin unit(Admin1 cannot add/remove users from USERS section) Third Answer: YES Admin2 is User admin at directory scope ,hence can reset pwd of any uses except the pwd of global admin/higher power roles

    Adapted from community discussion by reddevil01 · 2021-06-08 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. R

       reddevil01

       2021-06-08

       14 upvotes

       Admin1 and Admin2 are not members of Administrative group(Department1).However Admin1 has User administrator role scope for Department1 and Admin2 has User administrator role scope for the whole directory User 1 And User 2 are users of Department1 Group1(No members) and Group2(User 3 and User4 are members) are groups of Department1. FIrst Answer - NO Admin1 cannot reset the pwd for User 3 and User4 because they are part of group2.(User admin role assigned to admin unit cannot reset pwd of users present inside the group. Admin1 can reset the pwd of User1 and User2 who are not part of any groups inside the admin unit) Second Answer : YES Admin1 can add/remove users to the GROUPS present inside the admin unit(Admin1 cannot add/remove users from USERS section) Third Answer: YES Admin2 is User admin at directory scope ,hence can reset pwd of any uses except the pwd of global admin/higher power roles

    2. J

       Jhill777

       2022-11-29

       8 upvotes

       Correction: No, Yes, Yes. Confirmed in lab because that's the only time you'd see something this idiotic and difficult.

    3. J

       jack987

       2022-12-26

       7 upvotes

       I agree with Beitran. The correct answer is No, Yes, Yes. Here are some of the constraints for administrative units: Administrative units can't be nested. https://learn.microsoft.com/en-gb/azure/active-directory/roles/administrative-units

    4. R

       RandomNickname

       2022-06-07

       5 upvotes

       #1: N Because user 3,4 are nested and from G2 See below from; https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units "A scoped role assignment doesn't apply to members of groups added to an administrative unit, unless the group members are directly added to the administrative unit. For more information, see Add members to an administrative unit." #2: Y User Admin have the following attributes "microsoft.directory/groups/members/update" Which can be confirmed; https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator #3: Y, User1, is a direct member for the admin unit

11. Question 11 of 25

    You have an Azure Active Directory (Azure AD) tenant that contains a user named SecAdmin1. SecAdmin1 is assigned the Security administrator role. SecAdmin1 reports that she cannot reset passwords from the Azure AD Identity Protection portal. You need to ensure that SecAdmin1 can manage passwords and invalidate sessions on behalf of non-administrative users. The solution must use the principle of least privilege. Which role should you assign to SecAdmin1?

    • AAuthentication administrator
    • BHelpdesk administrator
    • CPrivileged authentication administrator
    • DSecurity operator

    Show answer

    Correct answer: B

    How others answered

    • B78%
    • A19%

    Explanation

    Answer must be B - Helpdesk Administrators. From the docs: Authentication administrator: can reset passwords for non-admins but can't invalidate sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#authentication-administrator Helpdesk administrator: Users with this role can change passwords, invalidate refresh tokens, manage service requests, and monitor service health. Invalidating a refresh token forces the user to sign in again. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#helpdesk-administrator Privileged Authentication Administrator: can reset all passwords (admins & non-admins) but can't invalidate any sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator Security Operator: can't reset any passwords. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-operator

    Adapted from community discussion by sezza_blunt · 2021-06-12 · 79 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. S

       sezza_blunt

       2021-06-12

       79 upvotes

       Answer must be B - Helpdesk Administrators. From the docs: Authentication administrator: can reset passwords for non-admins but can't invalidate sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#authentication-administrator Helpdesk administrator: Users with this role can change passwords, invalidate refresh tokens, manage service requests, and monitor service health. Invalidating a refresh token forces the user to sign in again. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#helpdesk-administrator Privileged Authentication Administrator: can reset all passwords (admins & non-admins) but can't invalidate any sessions. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-authentication-administrator Security Operator: can't reset any passwords. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#security-operator

    2. R

       rozgonyi

       2021-05-02

       65 upvotes

       Tl;dr: A In details: Privileged Auth Admin can reset passwords of non admins and admin accounts Helpdesk Admins can reset non admins and Helpdesk Admins password Authentication Administrator can only reset non admin accounts password To follow the least privilege requirement, Authentication Administrator should be the answer

    3. M

       med4

       2021-10-28

       26 upvotes

       not sure why this answer is top voted - auth admin can manage MFA settings which high prev - help desk admin can just manage passwords and invalided them ( invalided refresh token)

    4. J

       Jhill777

       2022-11-29

       7 upvotes

       Authenication Administrator Role Permmissions includes: microsoft.directory/users/invalidateAllRefreshTokens Force sign-out by invalidating user refresh tokens.

12. Question 12 of 25

    HOTSPOT - You have an Azure AD tenant that contains the users shown in the following table.

    

    You have the Azure AD Identity Protection policies shown in the following table.

    

    You review the Risky users report and the Risky sign-ins report and perform actions for each user as shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    N N N User 1 No The User Risk = Low. Then User risk policy blocked access. User 2 No The Sign-in Risk = Unknown. But it is Confirm Safe so we can ignore this. The User risk = Medium. The user risk policy block access. User 3 No User 3 User Risk is dismissed, but anonymous IP address risk (this is Sign-in Risk) is still at High level. Hence the sign-in risk policy blocked the access. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#nonpremium-sign-in-risk-detections

    Adapted from community discussion by doch · 2023-01-24 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. D

       doch

       2023-01-24

       30 upvotes

       N N N User 1 No The User Risk = Low. Then User risk policy blocked access. User 2 No The Sign-in Risk = Unknown. But it is Confirm Safe so we can ignore this. The User risk = Medium. The user risk policy block access. User 3 No User 3 User Risk is dismissed, but anonymous IP address risk (this is Sign-in Risk) is still at High level. Hence the sign-in risk policy blocked the access. https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#nonpremium-sign-in-risk-detections

    2. T

       ThotSlayer69

       2023-01-26

       19 upvotes

       User1 can sign in by using multi-factor authentication (MFA): No - Blocked access prevents self-remediation through password resets & Azure AD MFA User2 can sign in by using multi-factor authentication (MFA): No - Blocked access prevents self-remediation through password resets & Azure AD MFA User3 can sign in from an anonymous IP address: Yes - Anonymous IP address sign-in risk is Medium

    3. S

       Shena2021

       2023-09-17

       9 upvotes

       1. User1 can sign in by using multi-factor authentication (MFA). - No: User1's status is "Confirm user compromised," so access is blocked. 2. User2 can sign in by using multi-factor authentication (MFA). - No: User2's status is "Confirm sign-in safe," which means their access is allowed without MFA. 3. User3 can sign in from an anonymous IP address. - Yes: User3's status is "Dismiss user risk," and there's no mention of IP restrictions, so they can sign in from an anonymous IP address.

    4. W

       wsrudmen

       2023-01-25

       7 upvotes

       NO - User1 is now at High risk level after confirming user is compromised. Then User risk policy blocked access. NO - Sign-in of User 2 is safe. So we can bypass Sign-in risk policy Risk level of User2 is High due to the last action, so User risk policy block the access YES - User3 has "Dismiss risk User" so User Risk policy is bypassed. anonymous IP address is a risk, but context is missing to know if it's considered as an high risk. Maybe it's an outdated question when there were fix values defined by Microsoft for risk type. Anonymous IP was ranked as medium. Now we don't know how Microsoft calculates the risk level. https://www.rebeladmin.com/2020/11/step-by-step-guide-how-to-configure-sign-in-risk-based-azure-conditional-access-policies/

13. Question 13 of 25

    You have a Microsoft 365 tenant. All users have computers that run Windows 10. Most computers are company-owned and joined to Azure Active Directory (Azure AD). Some computers are user- owned and are only registered in Azure AD. You need to prevent users who connect to Microsoft SharePoint Online on their user-owned computer from downloading or syncing files. Other users must NOT be restricted. Which policy type should you create?

    • Aa Microsoft Cloud App Security activity policy that has Microsoft Office 365 governance actions configured
    • Ban Azure AD conditional access policy that has session controls configured
    • Can Azure AD conditional access policy that has client apps conditions configured
    • Da Microsoft Cloud App Security app discovery policy that has governance actions configured

    Show answer

    Correct answer: B

    How others answered

    • B77%
    • C23%

    Explanation

    B is the correct answer imo - https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices - You need to use "Use app enforced restrictions" from the "Session" control of the CA

    Adapted from community discussion by Val_0 · 2021-05-05 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. V

       Val_0

       2021-05-05

       38 upvotes

       B is the correct answer imo - https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices - You need to use "Use app enforced restrictions" from the "Session" control of the CA

    2. G

       Grotesmurf1980

       2022-01-11

       27 upvotes

       Just give your answer and stop saying you are "passed". Nobody can use this kind of info!!

    3. B

       Beitran

       2021-05-10

       14 upvotes

       So, first step is to create a Conditional Access Policy with Session configured in Azure AD, then create a Session Policy in Cloud App Security: https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-blocking-data-downloads-via-microsoft-cloud-app/ba-p/326357 So I'd say that since the first step is the Azure one the correct answer is B, since none of the other options for Cloud App Security make sense.

    4. R

       RandomNickname

       2022-06-07

       Selected B2 upvotes

       Initially the answer looked to be C, but reading the article posted in the question and some of the articles posted in the chat, B session control is correct. C: looks to portect and govern the use of apps. B: protects sessions established to customer tenant accessing it's data. Below export is found in: https://docs.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad "Conditional Access App Control enables user app access and sessions to be monitored and controlled in real time based on access and session policies. Access and session policies are used within the Defender for Cloud Apps portal to further refine filters and set actions to be taken on a user. With the access and session policies, you can: Prevent data exfiltration: You can block the download, cut, copy, and print of sensitive documents on, for example, unmanaged devices." As well as; https://docs.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices "Users on unmanaged devices will have browser-only access with no ability to download, print, or sync files"

14. Question 14 of 25

    The Azure Active Directory (Azure AD) tenant contains the groups shown in the following table.

    

    In Azure AD, you add a new enterprise application named App1. Which groups can you assign to App1?

    • AGroup1 only
    • BGroup2 only
    • CGroup3 only
    • DGroup1 and Group4
    • EGroup1 and Group3

    Show answer

    Correct answer: E

    How others answered

    • E54%
    • D44%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    MS documentation is not up to date! Just tested in my tenant, all the below groups are supported 1- Security 2- Microsoft 365 3- Mail-Enabled security Group

    Adapted from community discussion by HelloItsSam · 2023-02-16 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. H

       HelloItsSam

       2023-02-16

       21 upvotes

       MS documentation is not up to date! Just tested in my tenant, all the below groups are supported 1- Security 2- Microsoft 365 3- Mail-Enabled security Group

    2. I

       itismadu

       2023-10-27

       Selected E6 upvotes

       E according tohttps://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal

    3. J

       JN_311

       2023-06-08

       Selected E4 upvotes

       I tested adding M365 Group, was able to add group to enterprise app. Also the doco states it as well. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal Group-based assignment requires Azure Active Directory Premium P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only.

    4. A

       ACSC

       2023-09-27

       5 upvotes

       Answer: E Group-based assignment requires Microsoft Entra ID P1 or P2 edition. Group-based assignment is supported for Security groups and Microsoft 365 groups whose SecurityEnabled setting is set to True only. Nested group memberships aren't currently supported. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal?pivots=portal

15. Question 15 of 25

    You have a Microsoft 365 subscription. The subscription contains users that use Microsoft Outlook 2016 and Outlook 2013 clients. You need to implement tenant restrictions. The solution must minimize administrative effort. What should you do first?

    • AConfigure the Outlook 2013 clients to use modern authentication.
    • BUpgrade the Outlook 2013 clients to Outlook 2016.
    • CFrom the Exchange admin center, configure Organization Sharing.
    • DUpgrade all the Outlook clients to Outlook 2019.

    Show answer

    Correct answer: A

    How others answered

    • A60%
    • B40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Microsoft Office 2013 on Microsoft Windows computers supports Modern authentication. But, to turn it on, you need to configure the following registry keys https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/enable-modern-authentication?view=o365-worldwide

    Adapted from community discussion by PandaTuga · 2022-12-17 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. P

       PandaTuga

       2022-12-17

       Selected A12 upvotes

       Microsoft Office 2013 on Microsoft Windows computers supports Modern authentication. But, to turn it on, you need to configure the following registry keys https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/enable-modern-authentication?view=o365-worldwide

    2. P

       palito1980

       2022-10-04

       6 upvotes

       This is a very Microsoft question. Vague. Taking into consideration options and the fact that Office 2013 will reach the end of support on April 11, 2023, still supported, I'd go B as well. Office clients that use modern authentication (like OAuth 2.0) support tenant restrictions. O2013 natively does not. Easiest, least admin workload would be to upgrade. You could also https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/enable-modern-authentication?view=o365-worldwide. But more workload than upgrade.

    3. B

       BRoald

       2023-01-11

       4 upvotes

       A is true, because adding some register keys (and probally by GPO) is by far the least effort to do. If you upgrade from 2013 > 2016, it cost more effort and more time. So i would go with A

    4. R

       RemmyT

       2024-06-12

       1 upvote

       A) could work but Microsoft does not provide support. Support for connection to Microsoft 365 services with Office 2019 and Office 2016 ended on October 10, 2023. Office 2016 is now out of mainstream support, but its coverage was extended until October 2023. Older Office versions might still be able to connect to Microsoft 365 services, but that connectivity isn't supported. In practical terms, what this means is that older Office versions might not be able to use all the latest functionality and features of Microsoft 365 services. No active measures are made to block older Office versions from connecting to Microsoft 365 services if they're in extended support and are kept up to date. For example, Office 2019 and Office 2016, both of which are in extended support until October 14, 2025. https://learn.microsoft.com/en-us/deployoffice/endofsupport/microsoft-365-services-connectivity

16. Question 16 of 25

    HOTSPOT - You have a custom cloud app named App1 that is registered in Azure Active Directory (Azure AD). App1 is configured as shown in the following exhibit.

    

    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    From the Portal if you hover on the information next to the user assignment required it says: " If this option is set to yes, then users must first be assigned to this application before being able to access it. If this option is set to no, then any users who navigate to the application deep-link URL or application URL directly will be granted access. This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application. This option only functions with the following application types: applications configured for Federated Single Sign-on with SAML-based Authentication, Application Proxy applications that use Azure Active Directory Pre-Authentication or applications built directly on the Azure AD application platform that use OAuth 2.0 / OpenID Connect Authentication after a user or admin has consented to that application. This option has no effect when an application is configured for any of the other Single Sign-on modes." Therefore correct answer is: All users Assigned user in users and groups blade

    Adapted from community discussion by Saz · 2021-07-22 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. M

       MartiP

       2021-05-05

       84 upvotes

       Actually I think correct answers are: All users Assigned user in users and groups blade https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-configure

    2. S

       Saz

       2021-07-22

       10 upvotes

       From the Portal if you hover on the information next to the user assignment required it says: " If this option is set to yes, then users must first be assigned to this application before being able to access it. If this option is set to no, then any users who navigate to the application deep-link URL or application URL directly will be granted access. This option does not affect whether or not an application appears on My Apps. To show the application there, assign an appropriate user or group to the application. This option only functions with the following application types: applications configured for Federated Single Sign-on with SAML-based Authentication, Application Proxy applications that use Azure Active Directory Pre-Authentication or applications built directly on the Azure AD application platform that use OAuth 2.0 / OpenID Connect Authentication after a user or admin has consented to that application. This option has no effect when an application is configured for any of the other Single Sign-on modes." Therefore correct answer is: All users Assigned user in users and groups blade

    3. D

       Dipronil

       2021-11-15

       7 upvotes

       Wrong. https://docs.microsoft.com/en-us/learn/modules/plan-design-integration-of-enterprise-apps-for-sso/6-configure-pre-integrated-gallery-saas-apps Yes no Yes -> Assigned users can see the app and sign in.Unassigned users cannot see the app but can sign in. So only assigned user can see but unassigned users cannot see. According to the portal.

    4. A

       Azurefox79

       2021-06-24

       7 upvotes

       Trick question, the M365 app launcher ONLY shows M365 licensed apps, so no one will see App1 there as its a custom app. They may however see App1 in the myapps page if they are explicitly added; https://myapplications.microsoft.com. https://support.microsoft.com/en-us/office/meet-the-microsoft-365-app-launcher-79f12104-6fed-442f-96a0-eb089a3f476a

17. Question 17 of 25

    HOTSPOT - You have a Microsoft 365 tenant that contains a group named Group1 as shown in the Group1 exhibit. (Click the Group1 tab.)

    

    You create an enterprise application named App1 as shown in the App1 Properties exhibit. (Click the App1 Properties tab.)

    

    You configure self-service for App1 as shown in the App1 Self-service exhibit. (Click the App1 Self-service tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Just sharing my thoughts. 1. NO - Only direct members will have access. Approved users will be added to Group 1. 2. Yes - The approver will automatically become owner of the Group 1 after self service is configured. 3. NO - Visible to users is NO. So no one will be able to see the app.

    Adapted from community discussion by J4U · 2022-04-14 · 72 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. J

       J4U

       2022-04-14

       72 upvotes

       Just sharing my thoughts. 1. NO - Only direct members will have access. Approved users will be added to Group 1. 2. Yes - The approver will automatically become owner of the Group 1 after self service is configured. 3. NO - Visible to users is NO. So no one will be able to see the app.

    2. D

       d3N

       2021-12-01

       40 upvotes

       As the app is not visible for the users, I think the correct answer might be No,No,No. For reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-configure

    3. G

       girikedar

       2022-06-07

       27 upvotes

       Tested in tenant answer is NO, YES, YES 1) No : because Nesting is not supported 2)Yes : because approver user will automatically assigned as owner 3) Yes : because assigned user will always have app on myapplication.microsoft.com portal

    4. 0

       0byte

       2023-04-22

       13 upvotes

       N - Try adding a group to an app. There is a warning that only difect members will have access to the app. Nested groups are ignored Y - Try configuring self-service for any app - there is a message that any existing owners of the group will be replaced with the approver N - The wole point of this setting is to hide an app from users (as explained in info next to the setting). Some apps don't need to be visible, or require any interaction from users, to work.

18. Question 18 of 25

    HOTSPOT - Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company has a business partner named Fabrikam, Inc. Fabrikam uses Azure AD and has two verified domain names of fabrikam.com and litwareinc.com. Both domain names are used for Fabrikam email addresses. You plan to create an access package named package1 that will be accessible only to the users at Fabrikam. You create a connected organization for Fabrikam. You need to ensure that the package1 will be accessible only to users who have fabrikam.com email addresses. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-request-policy https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-create

    Adapted from community discussion by marsot · 2023-07-23 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. M

       marsot

       2023-07-23

       10 upvotes

       Correct. Box1: An access package POLICY in Identity Governance Access Package Policy specifies the policy by which subjects may request or be assigned an access package via an access package assignment. While Access PackageAssignment is an assignment of an access package to a particular subject for a period of time. Box2: The external Collaboration settings in Azure AD Portal > Azure AD > External Identities> External collaboration Settings > Collaboration restrictions > Deny invitation to specified domains Source: https://learn.microsoft.com/en-us/graph/api/resources/entitlementmanagement-overview?view=graph-rest-1.0

    2. S

       Sc300ExamDemo

       2024-05-26

       4 upvotes

       Box 1 - access package in Identity governance where you defined external users access only Box 2- external collaborations- block domains where you want to work with almost any domains except for a few https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list#add-a-blocklist

    3. T

       TafMuko

       2023-06-15

       4 upvotes

       I don't see how External Collaboration settings world play a part in this if they are both internal verified domains...

    4. I

       Imee

       2022-09-22

       4 upvotes

       on the exam 09222022, i answered the same. Passed the exam, btw.

19. Question 19 of 25

    You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure AD Identity Protection policies enforced. You create an Azure Sentinel instance and configure the Azure Active Directory connector. You need to ensure that Azure Sentinel can generate incidents based on the risk alerts raised by Azure AD Identity Protection. What should you do first?

    • AAdd a Microsoft Sentinel data connector.
    • BConfigure the Notify settings in Azure AD Identity Protection.
    • CCreate a Microsoft Sentinel playbook.
    • DModify the Diagnostics settings in Azure AD.

    Show answer

    Correct answer: A

    How others answered

    • A45%
    • C42%

    Only 45% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Add a Microsoft Sentinel Data connector is the wrong answer. Meant to mislead. Because question itself mentions that AAD connector was added. Which seem to cover all AAD functionality including Identity Protection feature. What you are asked to do is generate incidents based on the risk alerts. For that you use playbooks in Sentinel. Which automates tasks that SOC engineers need to such as generte risk alerts. So answer is C.

    Adapted from community discussion by DeepMoon · 2022-11-24 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. D

       DeepMoon

       2022-11-24

       22 upvotes

       Add a Microsoft Sentinel Data connector is the wrong answer. Meant to mislead. Because question itself mentions that AAD connector was added. Which seem to cover all AAD functionality including Identity Protection feature. What you are asked to do is generate incidents based on the risk alerts. For that you use playbooks in Sentinel. Which automates tasks that SOC engineers need to such as generte risk alerts. So answer is C.

    2. W

       w00t

       2022-09-12

       9 upvotes

       Wording is kind of weird. The data connector you're adding in Sentinel is called "Azure Active Directory Identity Protection". So yes, you're adding a data connector within Sentinel.

    3. R

       RemmyT

       2024-06-12

       Selected A2 upvotes

       Add a Microsoft Sentinel data connector. You create an Azure Sentinel instance and configure the Azure Active Directory connector. (Microsoft Entra ID connector) You need to ensure that Azure Sentinel can generate incidents based on the risk alerts raised by Azure AD Identity Protection We need : Microsoft Entra ID Protection (a different type connector) Microsoft Sentinel | Data connectors | Content hub - Microsoft Entra ID (we suppose is already enabled) - add Microsoft Entra ID Protection Description Note: Please refer to the following before installing the solution: • Review the solution Release Notes The Microsoft Entra ID Protection solution for Microsoft Sentinel allows you to ingest Security alerts reported in Microsoft Entra ID Protection for risky users and events in Microsoft Entra ID. Data Connectors: 1, Analytic Rules: 1, Playbooks: 5

    4. A

       armid

       2025-02-17

       Selected A2 upvotes

       I think A. First at this date the connectors in question would be "Entra ID" and "Entra ID Protection". Two separate connectors. The question is likely obsolete. However if i see it wit hthe wording of "Entra ID", i will answer A. If I see it with the wording of "Entra ID Protection" then I will go for D. https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-entra-id https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-entra-id-protection Think the order would be 1. the correct connector 2. diagnostic setting to forward the right logs to sentinel 3. playbook dont think B is used with regards to Sentinel, although maybe it somehow can, but this is more likely for notifying your admins for those not using Senitnel / NOC

20. Question 20 of 25

    HOTSPOT - You have an Azure Active Directory (Azure AD) ten-ant: that contains the groups shown in the following table.

    

    You create an access review for Group1 as shown in the following table.

    

    You create an access review for Group2 as shown in the following table.

    

    What is the minimum member of Azure Active Directory Premium P2 licenses required for each group? To answer, select the appropriate, options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Box 1: 525 - For Group1: Review scope: All Users, Reviewers: Users review own access Note: How many licenses must you have? Your directory needs at least as many Azure AD Premium P2 licenses as the number of employees who will be performing the following tasks: Member users who are assigned as reviewers Member users who perform a self-review Member users as group owners who perform an access review Member users as application owners who perform an access review For guest users, licensing needs will depend on the licensing model you're using. However, the below guest users' activities are considered Azure AD Premium P2 usage: Guest users who are assigned as reviewers Guest users who perform a self-review Guest users as group owners who perform an access review Guest users as application owners who perform an access review Box 2: 1 - For Group2: Review scope: Guest users only. Reviewers: Group Owner. Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#license-requirements

    Adapted from community discussion by jack987 · 2023-06-27 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. A

       ACSC

       2023-05-13

       29 upvotes

       Answer is: Group 1: 500 - Guest users (4th example in the link) Group 2: 1 https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#example-license-scenarios

    2. J

       jack987

       2023-06-27

       9 upvotes

       The correct answer is: Group 1: 500 Group 2: 1 Scenario = An administrator creates an access review of Group C with 50 member users and 25 guest users. Makes it a self-review. Calculation = 50 licenses for each user as self-reviewers.* Number of licenses = 50 * Azure AD External Identities (guest user) pricing is based on monthly active users (MAU), which is the count of unique users with authentication activity within a calendar month. This model replaces the 1:5 ratio billing model, which allowed up to five guest users for each Azure AD Premium license in your tenant. Refer to: https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#license-requirements

    3. T

       TheMCT

       2023-04-12

       7 upvotes

       The given answer is correct. Your directory needs at least as many Azure AD Premium P2 licenses as the number of employees who will be performing the following tasks: Member users who are assigned as reviewers Member users who perform a self-review Member users as group owners who perform an access review Member users as application owners who perform an access review

    4. K

       klayytech

       2024-10-12

       4 upvotes

       Group 1: 525 Group 2: 1 How many licenses must you have? Your directory needs at least as many Microsoft Entra ID Premium P2 licenses as the number of employees who will be performing the following tasks: Member users who are assigned as reviewers Member users who perform a self-review Member users as group owners who perform an access review Member users as application owners who perform an access review For guest users, licensing needs will depend on the licensing model you’re using. However, the below guest users’ activities are considered Microsoft Entra ID Premium P2 usage: Guest users who are assigned as reviewers Guest users who perform a self-review Guest users as group owners who perform an access review Guest users as application owners who perform an access review Microsoft Entra ID Premium P2 licenses are not required for users with the Global Administrator or User Administrator roles who set up access reviews, configure settings, or apply the decisions from the reviews.

21. Question 21 of 25

    HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains Azure AD Privileged Identity Management (PIM) role settings for the User administrator role as shown in the following exhibit.

    

    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    It is poor that after 8 months since the first comment here, these questions and answers have not been reviewed. This is a very simple update to a straightforward question. The

    Adapted from community discussion by 007Ali · 2022-01-14 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. M

       MajorUrs

       2021-05-16

       123 upvotes

       So correct answers are: 8 hours Global administrators and privileged role administrators

    2. K

       Krille

       2021-05-07

       41 upvotes

       "If no specific approvers are selected, privileged role administrators/global administrators will become the default approvers."

    3. 0

       007Ali

       2022-01-14

       8 upvotes

       It is poor that after 8 months since the first comment here, these questions and answers have not been reviewed. This is a very simple update to a straightforward question. The

    4. U

       User92

       2021-06-20

       6 upvotes

       Tested it, correct is indeed: 8 hours Global Admin or Privileged Role Admin

22. Question 22 of 25

    You have a Microsoft 365 E5 subscription that contains a user named User1. You need to ensure that User1 can create access reviews for Azure AD roles. The solution must use the principle of least privilege. Which role should you assign to User1?

    • APrivileged role administrator
    • BIdentity Governance Administrator
    • CUser administrator
    • DUser Access Administrator

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • B21%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    To create access reviews for Azure resources, you must be assigned to the Owner or the User Access Administrator role for the Azure resources. To create access reviews for Azure AD roles, you must be assigned to the Global Administrator or the Privileged Role Administrator role. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review#prerequisites

    Adapted from community discussion by kanag1 · 2023-08-03 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. K

       kanag1

       2023-08-03

       Selected A15 upvotes

       To create access reviews for Azure resources, you must be assigned to the Owner or the User Access Administrator role for the Azure resources. To create access reviews for Azure AD roles, you must be assigned to the Global Administrator or the Privileged Role Administrator role. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-roles-and-resource-roles-review#prerequisites

    2. I

       itismadu

       2023-10-26

       Selected A2 upvotes

       In Microsoft 365 (M365), users with specific roles can create access reviews for Azure Active Directory (Azure AD) roles. Here are the roles that can perform this task: Global Administrator: Global administrators have full access to all administrative features in Microsoft 365 and Azure AD, including the ability to create access reviews for Azure AD roles. Security Administrator: Security administrators have permissions to manage security-related settings in Azure AD, and they can create access reviews for Azure AD roles. Privileged Role Administrator: Privileged Role Administrators can manage assignments for privileged roles in Azure AD, including the ability to create access reviews for these roles.

    3. S

       shuhaidawahab

       2023-10-14

       4 upvotes

       The correct answer is B. Identity Governance Administrator. According to the web search results, the Identity Governance Administrator role can create and manage access reviews for Azure AD roles1. The Privileged role administrator role can only manage Azure AD roles, but not access reviews2. The User administrator and User Access Administrator roles do not have permissions to create or manage access reviews3.

    4. E

       eternalenvy

       2023-08-03

       Selected A3 upvotes

       To create access reviews for Azure resources, you must be assigned to the Owner or the User Access Administrator role for the Azure resources. To create access reviews for Azure AD roles, you must be assigned to the Global Administrator or the Privileged Role Administrator role.

23. Question 23 of 25

    HOTSPOT - You have a hybrid Microsoft 365 subscription that contains the users shown in the following table.

    

    You plan to deploy an on-premises app named App1. App1 will be registered in Azure AD and will use Azure AD Application Proxy. You need to delegate the installation of the Application Proxy connector and ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which user should perform the installation, and which role should you assign to User1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    The second answer might be Application developer. This MS Learn page says that you have to be at least a Cloud application administrator: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app However, another MS Learn page says that Application developer is enough: https://learn.microsoft.com/en-us/azure/active-directory/develop/web-app-tutorial-01-register-application I think I will go with Application developer, cause it's least privileged.

    Adapted from community discussion by penatuna · 2023-10-04 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. L

       Leacco99

       2023-09-23

       14 upvotes

       Admin 2 Application Developer as per link below. https://learn.microsoft.com/en-us/azure/active-directory/develop/web-app-tutorial-01-register-application

    2. P

       penatuna

       2023-10-04

       6 upvotes

       The second answer might be Application developer. This MS Learn page says that you have to be at least a Cloud application administrator: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app However, another MS Learn page says that Application developer is enough: https://learn.microsoft.com/en-us/azure/active-directory/develop/web-app-tutorial-01-register-application I think I will go with Application developer, cause it's least privileged.

    3. S

       Sc300ExamDemo

       2024-06-02

       3 upvotes

       Box 1 - admin2( app admin) https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#application-administrator Users in this role can create and manage all aspects of enterprise applications, application registrations, and application proxy settings. Box2- application developer https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#application-developer Users in this role can create application registrations when the "Users can register applications" setting is set to No.

    4. J

       JCkD4Ni3L

       2023-10-27

       4 upvotes

       You are wrong, Admin2 is an Application Administrator. However User1 has no roles, and the minimum role required to register an App is Application Developper. See doc: https://learn.microsoft.com/en-us/entra/identity-platform/web-app-tutorial-01-register-application#prerequisites

24. Question 24 of 25

    You need to meet the authentication requirements for leaked credentials. What should you do?

    • AEnable password hash synchronization in Azure AD Connect.
    • BConfigure Azure AD Password Protection.
    • CConfigure an authentication method policy in Azure AD.
    • DEnable federation with PingFederate in Azure AD Connect.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The question is Tricky! it mentions "meet authentication requirements" and if you just read this and go back up to read the "Authentication Requirements" there is nothing that mentioned anything related to needing PHS. HOWEVER!!!!!! If you read the whole question again "You need to meet the authentication requirements FOR LEAVK CREDENTIALS", you realize there is nothing that mentioned LEAKED CREDENTIALS on the "Authentications Requirements" related to it. The answer is A because none of the other ones has anything to do with LEAKED CREDENTIALS. You don't use B for anything related to LEAKED CREDENTIALS - You would use this one for addressing the requirement You don't use C for anything related to LEAKED CREDENTIALS You don't use D for anything related to LEAKED CREDENTIALS I had to read this multiple times!!! LOL

    Adapted from community discussion by Hot_156 · 2023-03-25 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. V

       Val_0

       2021-11-14

       26 upvotes

       @spinnetho - the correct answer is A - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#common-questions

    2. H

       Hot_156

       2023-03-25

       Selected A10 upvotes

       The question is Tricky! it mentions "meet authentication requirements" and if you just read this and go back up to read the "Authentication Requirements" there is nothing that mentioned anything related to needing PHS. HOWEVER!!!!!! If you read the whole question again "You need to meet the authentication requirements FOR LEAVK CREDENTIALS", you realize there is nothing that mentioned LEAKED CREDENTIALS on the "Authentications Requirements" related to it. The answer is A because none of the other ones has anything to do with LEAKED CREDENTIALS. You don't use B for anything related to LEAKED CREDENTIALS - You would use this one for addressing the requirement You don't use C for anything related to LEAKED CREDENTIALS You don't use D for anything related to LEAKED CREDENTIALS I had to read this multiple times!!! LOL

    3. E

       Efficia

       2022-12-30

       Selected A5 upvotes

       Password hash synchronization "Risk detections like leaked credentials require the presence of password hashes for detection to occur. For more information about password hash synchronization, see the article, Implement password hash synchronization with Azure AD Connect sync." https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-hash-synchronization

    4. S

       stromnessian

       2022-08-20

       Selected A5 upvotes

       It's A. Everyone knows that leaked credentials detection comes with PHS, right? Not sure why all the debate. Next question...

25. Question 25 of 25

    HOTSPOT - You need to identify which roles to use for managing role assignments. The solution must meet the delegation requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

    Adapted from community discussion by sapien45 · 2022-12-29 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-300 or CertExamHQ.

    1. S

       sapien45

       2022-12-29

       20 upvotes

       For Azure AD roles in Privileged Identity Management, only a user who is in the Privileged Role Administrator or Global Administrator role can manage assignments for other administrators. Global Administrators, Security Administrators, Global Readers, and Security Readers can also view assignments to Azure AD roles in Privileged Identity Management. For Azure resource roles in Privileged Identity Management, only a subscription administrator, a resource Owner, or a resource User Access administrator can manage assignments for other administrators. Users who are Privileged Role Administrators, Security Administrators, or Security Readers do not by default have access to view assignments to Azure resource roles in Privileged Identity Management. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

    2. M

       melatocaroca

       2022-01-12

       2 upvotes

       Requirements. Delegation Requirements Delegate the management of privileged roles by using Azure AD Privileged Identity Management (PIM). Prevent nonprivileged users from registering applications in the litware.com Azure AD tenant. Use custom catalogs and custom programs for Identity Governance. Ensure that User1 can create enterprise applications in Azure AD. Use the principle of least privilege. (To assign Azure roles, you must have User Access Administrator or Owner) For Azure AD roles in Privileged Identity Management, only a user who is following roles • Privileged Role Administrator o or • Global Administrator can manage assignments for other administrators For Azure AD roles in Privileged Identity Management view assignments only a user who is following roles. • Global Administrators, • Security Administrators, • Global Readers • Security Readers User administrator Create and manage all aspects of users and groups, manage support tickets, monitor service health, Change passwords for users, Helpdesk administrators, and other User Administrators

    3. N

       Nonyabuz

       2023-03-24

       1 upvote

       Step 4. Check your prerequisites To assign roles, you must be signed in with a user that is assigned a role that has role assignments write permission, such as Owner or ***User Access Administrator*** at the scope you are trying to assign the role. Similarly, to remove a role assignment, you must have the role assignments delete permission. Microsoft.Authorization/roleAssignments/write Microsoft.Authorization/roleAssignments/delete If your user account doesn't have permission to assign a role within your subscription, you see an error message that your account "does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write'." In this case, contact the administrators of your subscription as they can assign the permissions on your behalf. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps

    4. T

       TheGuy

       2022-09-13

       3 upvotes

       Second question is referring to Azure built-in roles and NOT Azure AD built-in roles, hence user access administrator Azure Roles: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Azure AD Roles: https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-300 practice, question 1 of 25