Examworthyexamworthy.comMicrosoft Identity and Access Administrator (SC-300) cheat sheet
Microsoft
Free to share. Examworthy is not affiliated with or endorsed by Microsoft; SC-300 and related marks belong to their respective owners.
At a glance
Format: Multiple choice and multiple response, at a Pearson VUE testing center or online proctored
Domain weight map
Heaviest first - spend your time hereHow this exam thinks
SC-300 is a build-it-correctly exam: nearly every question hands you a constrained scenario and asks for the single Microsoft Entra configuration that meets it with least privilege and least effort, and the traps are real features that fit all but one word of the requirement.
Spot the trap
Tempting wrong answers, and why they failCommon misconception
That re-hashing a password hash before upload means no usable credential reaches the cloud. Password hash sync still stores a credential derivative there.
Implement and Manage User Identities
Common misconception
That requiring MFA proves a device is managed and compliant. MFA verifies identity only; device health needs the compliant device grant control.
Implement Authentication and Access Management
Common misconception
That reusing one app registration's client secret across a whole VM fleet is a reasonable shortcut. It just spreads the same stored secret to every resource instead of removing it.
Plan and Implement Workload Identities
Common misconception
That reviewing the security group holding role members is the same as reviewing the role assignment. Group membership can drift from actual role holders.
Plan and Automate Identity Governance
Common misconception
That an object's GUID is permanently fixed and safe as a sync anchor across domains. objectGUID regenerates on cross-domain migration, breaking the link.
Implement and Manage User Identities
Common misconception
That security defaults and Conditional Access can run side by side. The tenant blocks creating a policy while defaults are enabled; defaults must be disabled first.
Implement Authentication and Access Management
Common misconception
That rotating and encrypting a client secret every ninety days satisfies a no-stored-secret requirement. The secret still sits on the server between rotations.
Plan and Implement Workload Identities
Common misconception
That adding a user directly to the group behind an access package is a fine shortcut. It bypasses the package's expiry and access review governance.
Plan and Automate Identity Governance
Key terms
Exam-day rules
- Name the owning mechanism first. Decide whether the stem is about Conditional Access, Microsoft Entra ID Protection, Privileged Identity Management, entitlement management, a workload identity, or hybrid sync before you read the options, so you narrow the field before comparing details.
- Re-read the requirement for the deciding constraint. When two options are real Microsoft Entra features that both sound plausible, the answer turns on a single detail in the stem, such as least administrative effort, near real time, no credential to clean up, or scoped to one app.
- Separate grant controls from session controls every time. Requiring multifactor authentication or a compliant device is a grant control; sign-in frequency and persistent browser are session controls. Many traps swap these, so label the requirement before you answer.
- Pick the least-privilege, lowest-effort option. When more than one configuration would technically work, the exam wants the one that uses the narrowest scope and the fewest ongoing manual steps, such as group-based licensing over per-user assignment or an app-scoped policy over an all-apps policy.
- Distinguish near-real-time revocation from expiry-based controls. If the stem demands a session ends within minutes of a directory change, it is continuous access evaluation, not a shorter token lifetime or sign-in frequency.
Revision schedule
- Day 1Read the blueprint and book a date
- Week 1Build the user and identity foundation
- Week 1 to 2Master authentication and Conditional Access
- Week 2 to 3Work through workload identities and app integration
- Week 3Automate identity governance