SC-300 Extras

SC-300 Overview & My Tips 

SC-300 or Microsoft Identity and Access Administrator is an associate (two star) certification from Microsoft.  It is aimed at people administering access to the Microsoft Cloud; Azure, Dynamics 365 and Microsoft 365. 

It is worth noting that whilst the skills and knowledge are relevant to administrators for all systems, the course and exam are based upon managing identity and access inAzure Active Directory.   

If, like me, you primarily work within Microsoft 365 you will need to become familiar with the carrying out the tasks in the Azure AD portal including navigation from https://portal.azure.com/ and the slightly different options available in some areas.    

As a Microsoft 365 Administrator if you use the link from the M365 Admin center you come to the  Azure AD portal https://aad.portal.azure.com/ and the navigation is slightly different. 

Even if you  are confident in carrying out the tasks specified in the M365 portals, I would strongly recommend you review the documentation for Azure AD and practice carrying out the tasks via the Azure AD interface as part of your exam prep. 

Because of this the references in this article are primarily Azure based. 

Disclaimer: All these links were correct at the time of posting.  But the Cloud changes regularly, so the referenced articles my change/be removed.  Please do post a comment if you spot a broken link or have suggestions to add so others can benefit too. 

General References 

• SC-300 Exam page https://docs.microsoft.com/en-us/learn/certifications/exams/sc-300 
• Microsoft Learn. Provides searchable learning paths and modules for a variety of roles and levels. https://docs.microsoft.com/en-us/learn/ 
• Learn TV. Digital content so you can always keep updated on the latest announcements, features, and products from Microsoft. https://docs.microsoft.com/en-us/learn/tv/ 
• Microsoft Azure Blog  https://azure.microsoft.com/en-us/blog/   
• Channel 9.  Informational videos, shows, and events on variety of technical topics. https://channel9.msdn.com/ 
• Microsoft Learning Community Blog. Get the latest information about the certification tests and exam study groups. https://www.microsoft.com/en-us/learning/community-blog.aspx 
• Azure Documentation https://docs.microsoft.com/en-us/azure/ 
• Microsoft 365 Documentation https://docs.microsoft.com/en-us/microsoft-365 
• Microsoft Security Documentation https://docs.microsoft.com/en-gb/security/ 

Taking a Microsoft Professional Exam 

There are a number of blogs about taking MCP exams.  My personal favourites are: 

• Certification process overview | Microsoft Docs 
• Microsoft Certifications – Microsoft Exam duration and question types – tiagocosta.com 
• An MCT’s perspective on taking a Microsoft Fundamentals Exam (FAQ’s) – @Microsoft365Pro 
• How to take a Microsoft Certification Exam Online – Thomas Maurer 

Pre-study References 

Before attending an SC-300 course you should have a good understanding of security fundamentals in the Microsoft Cloud.  These resources can help.  

• My SC-900 Extras Page
• Introduction to Azure security (Microsoft Learn) https://docs.microsoft.com/en-us/azure/security/fundamentals/overview 
• Introduction to Microsoft 365 Security & Compliance (Microsoft Learn) https://docs.microsoft.com/en-us/learn/paths/m365-security-compliance-capabilities/ 
• Azure identity management security overview https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-overview 
• Security, Compliance, and Identity Fundamentals (Learn)  
  • SC-900 part 1: Describe the concepts or security, compliance, and identity https://docs.microsoft.com/en-us/learn/paths/describe-concepts-of-security-compliance-identity/ 
  • SC-900 part 2: Describe the capabilities of Microsoft identity and access management https://docs.microsoft.com/en-us/learn/paths/describe-capabilities-of-microsoft-identity-access/ 
  • SC-900 part 3: Describe the capabilities of Microsoft security solutions https://docs.microsoft.com/en-us/learn/paths/describe-capabilities-of-microsoft-security-solutions/ 
  • SC-900 part 4: Describe the capabilities of Microsoft compliance solutions https://docs.microsoft.com/en-us/learn/paths/describe-capabilities-of-microsoft-compliance-solutions/ 
• Microsoft Azure Well-Architected Framework Security (Learn) https://docs.microsoft.com/en-us/learn/modules/azure-well-architected-security/ 

Microsoft Learn Learning Paths (SC-300) 

• Implement an identity management solution  https://docs.microsoft.com/en-us/learn/paths/implement-identity-management-solution/ 
• Implement an Authentication and Access Management Solution https://docs.microsoft.com/en-us/learn/paths/implement-authentication-access-management-solution/ 
• Implement Access Management for Apps https://docs.microsoft.com/en-us/learn/paths/implement-access-management-for-apps/ 
• Plan and Implement and Identity Governance Strategy https://docs.microsoft.com/en-us/learn/paths/plan-implement-identity-governance-strategy/ 

References by Exam Objectives  

Implement an identity management solution (25-30%) 

Implement initial configuration of Azure Active Directory  

• configure and manage Azure AD directory roles
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal
  • https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-by-task
• configure and manage custom domains
  • https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/domains-manage
  • Domain names can also be managed through the Microsoft 365 Admin portal, though the exam and course focus on the Azure AD portal https://docs.microsoft.com/en-us/microsoft-365/admin/setup/add-domain?view=o365-worldwide
• configure and manage device registration options
  • https://docs.microsoft.com/en-us/azure/active-directory/devices/overview
• configure delegation by using administrative units
  • https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-administrative-units
• configure tenant-wide settings
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis?context=azure/active-directory/users-groups-roles/context/ugr-context

Create, configure, and manage identities  

• create, configure, and manage users  
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-manage-groups  
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory  
• create, configure, and manage groups  
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal  
  • https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-create-rule  
• manage licenses  
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-licensing-whatis-azure-portal 

Implement and manage external identities  

• manage external collaboration settings in Azure Active Directory  
  • https://docs.microsoft.com/en-us/azure/active-directory/external-identities/  
• invite external users (individually or in bulk)  
  • https://docs.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite  
• manage external user accounts in Azure Active Directory  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users  
• configure identity providers (social and SAML/WS-fed) 
  • https://docs.microsoft.com/en-us/azure/active-directory-b2c/connect-with-saml-service-providers  
  • https://docs.microsoft.com/en-us/azure/active-directory-b2c/tutorial-add-identity-providers 

Implement and manage hybrid identity  

• implement and manage Azure Active Directory Connect (AADC)  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect 
• implement and manage Password Hash Synchronization (PHS)  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash-synchronization  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity  
• implement and manage Pass-Through Authentication (PTA)  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta-quick-start  
• implement and manage seamless Single Sign-On (SSO)  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start  
• implement and manage Federation excluding manual ADFS deployments 
  • https://docs.microsoft.com/en-us/azure/active-directory/external-identities/identity-providers  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed  
• implement and manage Azure Active Directory Connect Health  
  • https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect  
• troubleshoot synchronization errors 

Implement an authentication and access management solution (25-30%) 

Plan and implement Azure Multifactor Authentication (MFA)  

• plan Azure MFA deployment (excluding MFA Server) 
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted  
• implement and manage Azure MFA settings  
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings  
• manage MFA settings for users 
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userdevicesettings 

Manage user authentication  

• administer authentication methods (FIDO2 / Passwordless)  
  • https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification  
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods  
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks  
• implement an authentication solution based on Windows Hello for Business  
  • https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad  
• configure and deploy self-service password reset  
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks  
• deploy and manage password protection 
  • https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy  
• implement and manage tenant restrictions  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions 

Plan, implement, and administer conditional access 

• plan and implement security defaults 
  • https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults 
• Plan conditional access policies  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/plan-conditional-access  
• implement conditional access policy controls and assignments (targeting, applications, and conditions)  
  • https://docs.microsoft.com/en-us/appcenter/general/configuring-aad-conditional-access  
• testing and troubleshooting conditional access policies  
• implement application controls  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-protection-based-conditional-access  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-conditional-access  
  • https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy  
• implement session management  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime  
• configure smart lockout thresholds 

Manage Azure AD Identity Protection  

• implement and manage a user risk policy  
  • https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies  
• implement and manage sign-in risk policies  
• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies  
• implement and manage MFA registration policy  
• monitor, investigate and remediate elevated risky users  
• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk 

Implement Access Management for Apps (10-15%) 

Plan, implement, and monitor the integration of Enterprise Apps for Single Sign-On (SSO)  

• implement and configure consent settings  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-app-consent-policies  
• discover apps by using MCAS or ADFS app report  
  • https://docs.microsoft.com/en-us/cloud-app-security/discovered-apps  
  • https://docs.microsoft.com/en-us/cloud-app-security/tutorial-shadow-it  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-adfs-application-activity  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/cloud-app-security  
• design and implement access management for apps  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app  
• design and implement app management roles  
  • https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/tenant-restrictions  
• monitor and audit access / Sign-Ons to Azure Active Directory integrated enterprise applications o https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs o https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-usage-insights-report  
• integrate on-premises apps by using Azure AD application proxy o https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy o https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/application-proxy  
• integrate custom SaaS apps for SSO o https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/non-gallery-apps  
• configure pre-integrated (gallery) SaaS apps o https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal o https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/tutorial-list  
• implement application user provisioning o https://docs.microsoft.com/en-us/azure/active-directory/app-provisioning/user-provisioning 

Implement app registrations  

• plan your line of business application registration strategy  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added  
• implement application registrations  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app  
• configure application permissions  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent  
• implement application authorization  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-add-app-roles-in-azure-ad-apps  
  • https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-enterprise-app-role-management  
  • https://docs.microsoft.com/en-us/azure/architecture/multitenant-identity/app-roles  
• plan and configure multi-tier application permissions 

Plan and implement an Identity Governance Strategy (25-30%) 

Plan and implement entitlement management  

• define catalogs  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-scenarios  
• define access packages  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-scenarios  
• plan, implement and manage entitlements  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-scenarios  
• implement and manage terms of use  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/terms-of-use  
• manage the lifecycle of external users in Azure AD Identity Governance settings 

Plan, implement, and manage access reviews  

Most of this objective is covered by 2 articles: 

https://docs.microsoft.com/en-us/azure/active-directory/governance/deploy-access-reviews  and https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview 

• plan for access reviews 
• create access reviews for groups and apps 
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review  
• monitor access review findings  
  • https://docs.microsoft.com/en-us/azure/active-directory/governance/manage-user-access-with-access-reviews  
• manage licenses for access reviews  
• automate access review management tasks  
• configure recurring access reviews 

Plan and implement privileged access  

Most of this objective is covered by 1 article:  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/  

• define a privileged access strategy for administrative users (resources, roles, approvals, thresholds)  
• configure Privileged Identity Management for Azure AD roles  
• configure Privileged Identity Management for Azure resources  
• assign roles  
• manage PIM requests  
• analyze PIM audit history and reports  
• create and manage break-glass accounts  
  • https://docs.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access  
  • https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-block-access 

Monitor and maintain Azure Active Directory  

• analyze and investigate sign-in logs to troubleshoot access issues  
  • https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins  
• review and monitor Azure AD audit logs  
  • https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs  
• enable and integrate Azure AD diagnostic logs with Log Analytics / Azure Sentinel  
  • https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory  
• export sign-in and audit logs to a third-party SIEM  
  • https://azure.microsoft.com/en-us/blog/use-azure-monitor-to-integrate-with-siem-tools/  
• review Azure AD activity by using Log Analytics / Azure Sentinel, excluding KQL use  
  • https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-install-use-log-analytics-views  
• analyze Azure Active Directory workbooks/reporting  
  • https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-usage-insights-report  
• configure notifications  
  • https://docs.microsoft.com/en-us/azure/active-directory-domain-services/notifications