Microsoft Identity and Access SC-300 Cheat Sheet – 2026 Exam Notes

The SC-300: Microsoft Identity and Access Administrator exam is the "Identity Bible" for the Microsoft ecosystem. While AZ-104 touches on users and groups, SC-300 dives deep into Zero Trust, Conditional Access logic, and Identity Governance.

In 2026, the focus has shifted heavily toward Microsoft Entra ID and Security Service Edge (SSE) capabilities. Here are the core pillars you need to master.

1. Implement Microsoft Entra ID

The foundation of the identity perimeter.

Identity Lifecycle

• User Management: Understand Guest accounts (B2B) vs. External Identities (B2C).
• Self-Service Password Reset (SSPR): * Requirement: Azure AD Free (for cloud users), P1/P2 for write-back to on-prem.
  • Methods: Email, SMS, Authenticator App, Security Questions.
• Device Identity: * Entra Registered: BYOD (Personal devices).
  • Entra Joined: Corporate-owned, cloud-native.
  • Hybrid Entra Joined: On-prem AD joined + synced to cloud.

Hybrid Identity

• Entra Connect vs. Cloud Sync: * Connect: Supports Pass-through Auth (PTA) and device write-back.
  • Cloud Sync: Lightweight agent, manages multi-forest/disconnected environments.

2. Authentication and Access Management

This is the "meat" of the exam.

Conditional Access (CA) - The "If/Then" Engine

• Signals: User/Group, Location (IP), Device State, Application, Risk (P2).
• Controls: Block access, Grant access (require MFA, require Compliant Device, require Password Change).
• Logic: CA policies are additive. If two policies apply, the most restrictive "Block" always wins.

Multi-Factor Authentication (MFA)

• Registration Campaign: Nudging users to move from SMS to Microsoft Authenticator.
• Authentication Strengths: Defining specific requirements (e.g., "Phishing-resistant" only like FIDO2) in CA policies.

3. Identity Governance

Managing "Who has access to what, and for how long?"

Privileged Identity Management (PIM)

• Just-In-Time (JIT) Access: Users are not permanent admins. They "activate" the role for 1–8 hours.
• Activation: May require MFA, a justification, or approval from a designated manager.

Entitlement Management

• Access Packages: A bundle of resources (Groups, Apps, SharePoint) that a user can request via a portal.
• Access Reviews: Automated "re-certification." If a user doesn't respond, you can auto-remove their access.

4. Global Secure Access (The 2026 "Must-Know")

The evolution of Zero Trust: Extending Entra ID to the network.

Entra Private Access (Zero Trust Network Access - ZTNA)

• What it is: A VPN replacement.
• How it works: Uses a lightweight connector on-prem to allow users to access private apps (RDP, SSH, SMB) without exposing the whole network.
• Exam Tip: It allows you to apply Conditional Access to legacy on-prem applications.

Entra Internet Access (Secure Web Gateway - SWG)

• What it is: Secures access to the internet and SaaS apps (like Microsoft 365).
• Key Feature: Compliant Network check. You can block access to M365 unless the traffic originates from the verified Entra Internet Access tunnel.
• Universal Tenant Restriction: Prevents users from using corporate devices to log into other "personal" tenants.

5. App Registration & Permissions

Securing the programmatic side of Identity.

• App Registration: The "Blueprint" (for developers).
• Enterprise Application: The "Service Principal" (the actual instance/identity).
• Delegated vs. Application Permissions: * Delegated: Acts as the user.
  • Application: Acts as a background service (requires Admin Consent).

SC-300 "Cheat Sheet" Quick Facts

Exam "Gotchas"

1. Tags vs. Policies: Like AZ-104, tags don't grant permissions. Use RBAC.
2. Break-glass Accounts: Always have two cloud-only Global Admins excluded from MFA/CA policies to prevent lockouts.
3. Emergency Access: If you see "Impossible Travel," it’s always Entra ID Identity Protection (P2).
4. Verified ID: For digital wallets and identity verification (new for 2026).

Good luck on your SC-300!