SC-300 - Implement Authentication and Access Management (25% of the exam) - Section 2.1

Plan and manage Microsoft Entra authentication methods including passwordless options.

Describe certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, and passkeys (FIDO2) as options in the authentication methods policy. Select the right combination for a given security posture and recognise when a Temporary Access Pass is needed to onboard a passwordless credential.

certificate-based authenticationTemporary Access PassOAuth 2.0 tokensMicrosoft Authenticatorpasskeys (FIDO2)authentication methods policy

Practice question for this objective

Free sampleImplement Authentication and Access Managementmedium

A new starter receives a corporate laptop but has no existing credential and must register a FIDO2 security key for passwordless sign-in on their first day, without a help desk agent setting a temporary password. Which Microsoft Entra authentication method should an administrator issue so the user can complete onboarding and register the key?

AIssue a Temporary Access Pass so the new starter signs in with the time-limited passcode and then registers the FIDO2 security key from My Sign-Ins. Correct
BIssue a self-service password reset link so the new starter can set an initial password and then enrol the FIDO2 security key from My Sign-Ins.
CIssue an OATH hardware token so the new starter signs in with the rotating code and then registers the FIDO2 security key from My Sign-Ins.
DIssue a Microsoft Authenticator push registration so the new starter approves a prompt and then registers the FIDO2 security key from My Sign-Ins.

A Temporary Access Pass is the time-limited credential used to onboard users with no existing method so they can register passwordless options. A Temporary Access Pass is a one-time or time-limited passcode created by an administrator that lets a user without any registered credential sign in and then enrol strong methods like a FIDO2 key. Self-service reset, OATH tokens, and Authenticator all presume an existing credential, so none of them bootstraps a fresh account on its own.

Why A is correct: A Temporary Access Pass is a time-limited passcode designed to onboard users with no existing credential so they can register passwordless methods such as a FIDO2 key, matching the requirement exactly.

Why B is wrong: Self-service password reset still produces a password-based credential and assumes the user already has a registered method to verify, so it does not bootstrap a brand new account cleanly.

Why C is wrong: An OATH hardware token is a second factor that supplements a password; it cannot serve as the primary bootstrap credential for an account that has no password set yet.

Why D is wrong: Registering Authenticator itself needs an existing verified credential to start the flow, so it cannot be the first method handed to an account that has nothing registered.

See more SC-300 practice questions, answers explained.

Exam traps in Implement Authentication and Access Management

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Microsoft Authenticator push approval with number matching, where the admin types the displayed number into the app to confirm the pending sign-in request.
Why it is wrong: Number matching defeats blind approval and prompt fatigue, but the approval is not bound to the sign-in origin, so a real-time relay can still capture it and it is not phishing-resistant.
Increase the maximum lifetime of the Temporary Access Pass in the policy, so a longer-lived pass automatically permits the contractor to sign in with it more than once.
Why it is wrong: Lifetime only sets how long a pass remains valid, not how many times it can be used, so a one-time pass still stops working after the first sign-in no matter how long its lifetime is.
Set a Conditional Access grant control that requires a Temporary Access Pass, so the contractor can present the same pass on each device during onboarding.
Why it is wrong: Conditional Access decides when a control is required at sign-in and cannot make a pass reusable or extend its lifetime, so it does not change how the pass itself behaves.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.