Microsoft Identity and Access Administrator SC-300 Exam Questions

Answer : E

For Identity Governance (Entitlement Management), the materials clarify who can create and manage access reviews of access packages: ''To create or manage access reviews for access packages, you must be a Global administrator, an Identity Governance administrator, a catalog owner for the catalog that contains the access package, or an access package manager.'' The exam text also states: ''User administrator does not grant the ability to manage entitlement management access reviews unless the user is delegated as a catalog owner or access package manager.'' Given the scenario's user roles, User3 (Identity Governance administrator) and User5 (Global administrator) satisfy these permissions and therefore can create and manage the access review for Package1. By contrast, User4 (User administrator) cannot perform this task by role alone. This selection follows the least-privilege guidance emphasized in SC-300: use specialized governance roles (Identity Governance admin or delegated catalog roles) rather than broad directory roles when possible.

Answer : D

The SC-300 official study guide and Microsoft Learn: Manage Access Reviews confirm that Access Reviews in Azure AD can target user-based groups, Azure AD roles, and enterprise applications. However, dynamic device groups are not supported for access reviews.

Answer : A

The AWS connector in Microsoft Defender for Cloud Apps is designed to integrate activity logs, user authentication data, and app permissions granted through OAuth. This connector enables monitoring of OAuth token use, identity federation events, and cross-service authentication.

From the official Microsoft Learn content:

''When the AWS app connector is added, Defender for Cloud Apps collects OAuth activity and permissions information to detect anomalous behavior or excessive app permissions.''

This fulfills the requirement to monitor OAuth authentication requests from AWS and its associated accounts. Therefore, adding the AWS app connector meets the goal.

Answer : B

In Azure AD Privileged Identity Management (PIM) for Azure AD roles, the exam materials describe that you tailor how a role (for example, User administrator) is used by editing its Role settings. These settings control activation behavior, including require multi-factor authentication, justification, approval, assignment/activation durations, and notifications. The guide states that administrators can ''configure activation requirements and time-bound eligibility on a per-role basis'' and ''enforce approval workflows and MFA at activation.'' Access reviews are used to periodically verify who still needs a role, but they do not implement the operational changes to how the role is activated. Active assignments simply shows and changes who currently holds active/eligible assignments; it does not set policy for the role's activation behavior. Administrative units scope certain directory tasks, but they are not how you change PIM activation/approval/MFA requirements. Therefore, to meet planned changes for the User administrator role (such as least privilege activation with approval, justification, and MFA), you update PIM Azure AD roles User administrator Role settings. This aligns with the SC-300 objective to ''configure PIM settings and policies for Azure AD roles,'' ensuring governance by policy rather than ad-hoc assignment.

Answer : C

When onboarding to Microsoft Entra Permissions Management (a CIEM solution), before a user can perform any functions inside Permissions Management, that user must be granted an appropriate Permissions Management role in the Entra tenant. The principle of least privilege dictates that you grant only the minimal role necessary (for example, a Permissions Management Approver, Viewer, or Controller). The SC-300 study materials and Microsoft's documentation emphasize that administrative access must begin by assigning roles within Entra ID.

Creating a security group (option A) is a useful organizational practice but doesn't itself grant the user permissions inside Permissions Management. Creating a role/policy template (option B) is about defining permission scopes and is not a first step to allow a user access. Creating a request in My Requests (option D) presupposes that User1 already has some entitlement to make requests (i.e. some role), which they don't yet.

Therefore, the first action is to assign a Permissions Management role to User1 from the Entra admin center, thus giving them appropriate access while adhering to least privilege.

Answer : D

In Azure AD, user consent and admin consent workflows control which users or administrators can approve access to organizational data requested by applications.

The question states:

''Users can request admin consent to apps they are unable to consent to: Yes''

''Who can review admin consent requests: Admin2, User2''

When User1 attempts to add an app that requires consent to access company data, and if that app requires admin consent, the request is routed to those designated as admin consent reviewers. In this case, Admin2 and User2 are listed, but only one has the administrative capability to approve the request.

Based on Microsoft documentation:

''Only users who hold an administrative role such as Global Administrator, Cloud Application Administrator, or Authentication Administrator and are designated as reviewers can grant consent on behalf of the organization.''

Here, Admin2 holds the Authentication Administrator role --- an Azure AD admin-level role --- while User2 has no administrative privileges. Thus, Admin2 is the only eligible user to approve the admin consent request.

Answer : B

This scenario involves Admin Consent Requests in Azure AD. When users try to use apps that require admin consent, requests are sent to designated reviewers who can approve or deny them.

Admin1: Cloud Application Administrator --- can review and approve admin consent requests.

Admin2: Application Administrator --- can review and approve admin consent requests.

Admin3: Security Administrator --- cannot approve app consent requests because this role does not have application management privileges.

User1: No role assigned --- can be listed as a reviewer but cannot approve, only receive notifications.

From Microsoft Documentation:

''Only users with sufficient permissions, such as the Application Administrator or Cloud Application Administrator roles, can grant admin consent in response to consent requests.''

Therefore, only Admin1 and Admin2 meet the requirement to review and approve.