Microsoft Identity and Access Administrator SC-300 Exam Questions

Answer : D

In Azure AD Privileged Identity Management (PIM), administrators manage, activate, and review eligible and active assignments for Azure AD roles, Azure resources, and privileged access groups.

To identify users who are eligible for a specific Azure AD role --- such as Cloud Application Administrator --- you must navigate to the Azure AD roles blade under PIM.

Path: Azure AD Privileged Identity Management Azure AD roles Roles Select ''Cloud Application Administrator'' View ''Eligible assignments''.

From Microsoft's official documentation:

''To view eligible assignments for Azure AD roles, use the Azure AD roles blade within Privileged Identity Management. This lists users who are eligible or active for each role.''

Answer : C, D

In Azure AD Privileged Identity Management (PIM), the SC-300 materials explain that role assignment type determines how a user obtains permissions. An eligible assignment means the user requests activation when needed; an active assignment grants continuous permissions. As the guide states, ''Eligible assignments require the user to activate the role for just-in-time access, while active assignments grant standing access.'' To allow users of the User administrator role to request the role when needed, you must set assignments to Eligible rather than active.

The same objective also calls for ensuring this capability is available ''for up to one year.'' In PIM role configuration, the duration of an eligibility is controlled by the Expire eligible assignments after policy. The documentation describes that administrators can ''configure the maximum duration for eligible assignments by setting 'Expire eligible assignments after' to a specific period (for example, months up to one year).'' Therefore, you must modify the ''Expire eligible assignments after'' setting to the required period.

No requirement mentions activation justification or ticket metadata; those are optional controls used to add context to activations. Consequently, the two actions that directly satisfy the stated technical requirement are: set all assignments to Eligible (C) and configure ''Expire eligible assignments after'' (D).

Answer : D

According to the Microsoft Identity and Access Administrator (SC-300) Study Guide and the Microsoft Learn -- ''Manage Microsoft 365 Groups naming policies'' documentation, group naming policies in Azure Active Directory (now Microsoft Entra ID) apply to end users who create Microsoft 365 groups, but do not apply to administrators who have roles that allow them to override naming restrictions.

The policy defines conventions such as prefixes, suffixes, blocked words, and enforced naming rules. However, certain administrative roles are exempt from this policy to allow organizational management and automation processes. The exempt roles are:

Global Administrator

User Administrator

These two roles can create Microsoft 365 groups without the naming policy constraints. Other users --- including Groups Administrator and users without administrative roles --- are subject to the naming policy when creating groups.

From the official documentation:

''Naming policies apply to all users who create groups, except for global administrators and user administrators. These roles can create groups that bypass the naming policy restrictions.''

Applying this rule:

User1 (Global Administrator) --- exempt

User2 (User Administrator) --- exempt

User3 (Groups Administrator) --- affected by the policy

User4 (no role) --- affected by the policy

Answer : B

In Azure AD access reviews, the Reviewer type determines who gets the review tasks. The SC-300 materials explain that selecting ''Members (self)'' triggers self-attestation, meaning each user only reviews their own access. The guidance states that when you use Members (self), ''each user reviews only their own access,'' and owners or other people do not receive tasks for others. Your goal is for each department's manager to review their staff's access. For that, the documented reviewer choice is Manager (leveraging the user's manager attribute) and, optionally, fallback reviewers to catch users without a manager value. The exhibits show all requests going to Megan Bowen, which typically occurs when Manager is selected but many users lack a populated manager attribute---thus the tasks fall back to the specified fallback reviewer. Changing the reviewer to Members (self) would not route tasks to managers; it would simply ask every user to attest to their own access, failing the goal of manager-based attestation by department. Therefore, the proposed solution does not meet the requirement.

Answer : B

In Azure AD, license automation is implemented through group-based licensing. The SC-300 materials explain that ''you can assign licenses to a group in Azure Active Directory; when you assign a license to a group, all users who are members of the group are assigned that license''. They also clarify that ''dynamic group membership uses rules to automatically add or remove users based on user attributes'', which is the recommended way to on-board new populations without manual effort. For licensing, the guide is explicit that ''group-based licensing works with security groups and Microsoft 365 Groups'' and that ''distribution lists are not supported for license assignment''. Administrative Units are described as ''a scoping mechanism for delegating administrative permissions to subsets of users and devices'', not a licensing entity. Likewise, Organizational Units (OUs) are on-premises AD containers and ''do not control license assignment in Azure AD''.

Given the requirement to allocate licenses automatically to new A. Datum users as they appear, the least-effort, policy-driven approach is to create an Azure AD Dynamic User security group with a membership rule that targets those users (for example, by domain, company attribute, or a synced attribute), then assign the required Microsoft 365/Azure AD licenses to that group. As the documentation notes, ''when users join or leave the group based on the rule, licenses are added or removed automatically.''

Answer : D

Answer : D

In Azure AD Identity Protection, risk detections are classified into sign-in risks and user risks. According to Microsoft's SC-300 Study Guide and Identity Protection documentation, a user risk represents the probability that an account has been compromised. Microsoft aggregates multiple sign-in signals and applies its threat intelligence algorithms to determine whether a user's identity may be at risk. Among the listed options, Password spray, Anonymous IP address, and Unfamiliar sign-in properties are sign-in risk detections, while Azure AD threat intelligence is the only type classified as a user risk detection.

Microsoft Docs states: ''User risk detections are generated by Azure AD threat intelligence when Microsoft detects that user credentials appear to be compromised.''