SC-300 - Implement Authentication and Access Management (25% of the exam) - Section 2.2

Implement and manage multifactor authentication, self-service password reset, Windows Hello for Business, and password protection.

Configure tenant-wide MFA settings, self-service password reset, Windows Hello for Business, and Microsoft Entra password protection including banned-password lists. Apply session revocation to immediately terminate active sessions when a user's risk level changes.

tenant-wide MFA settingsself-service password resetWindows Hello for BusinessMicrosoft Entra password protectionsession revocation

Practice question for this objective

Free sampleImplement Authentication and Access Managementhard

An administrator configures a Microsoft Entra ID Protection user risk policy that grants access only after the user self-remediates. The team wants the access control that both unblocks the user and lowers their accumulated user risk to a safe state automatically. Which grant control should the policy use?

ARequire multi-factor authentication, because completing a second factor proves the identity is genuine and resets the accumulated user risk to a low level.
BRequire the device to be marked as compliant, because a healthy Microsoft Intune device proves the account is safe and clears the standing user risk score.
CRequire approved client app, because forcing a managed application to reauthenticate the account confirms the user is legitimate and resets the user risk.
DRequire password change, because a secure self-service password reset remediates the compromised credential and automatically returns the user risk to a safe state. Correct

The require password change grant control remediates user risk by forcing a secure self-service password reset, which automatically returns the user risk score to safe. User risk reflects a possibly compromised credential, so the matching remediation is a secure password change via self-service password reset. When the user completes it, Microsoft Entra ID Protection treats the credential as remediated and lowers the user risk to safe. MFA remediates sign-in risk, while device compliance and approved client app address unrelated conditions and never clear user risk.

Why A is wrong: MFA addresses sign-in risk remediation; passing MFA alone does not clear accumulated user risk, so the user remains flagged as risky after authenticating.

Why B is wrong: Device compliance verifies device health, not identity remediation; it does not prompt a credential reset and therefore cannot return an elevated user risk score to safe.

Why C is wrong: Approved client app limits which applications connect and has no link to user risk remediation, so the standing user risk is never cleared by this control.

Why D is correct: A secure password change through self-service password reset is the user risk remediation control; it invalidates the suspect credential and ID Protection then lowers the user risk to safe automatically.

See more SC-300 practice questions, answers explained.

Exam traps in Implement Authentication and Access Management

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Turn on password hash synchronisation so the on-premises Active Directory password is copied up to Microsoft Entra ID after each reset
Why it is wrong: Password hash synchronisation flows hashes from on-premises up to the cloud, so it is tempting, but it does not push a cloud reset back down to Active Directory.
Select Confirm user compromised, which feeds the detections to the model as true positives so future scoring improves for similar activity.
Why it is wrong: Confirm user compromised is a real report action and feeds true positives, but it raises risk to high rather than returning the user to a safe state.
Enable security defaults, which automatically enforces a strong password policy that rejects the company name and common seasonal words.
Why it is wrong: Security defaults enforces baseline protections such as multifactor authentication registration, but it does not provide a configurable list of organisation-specific banned terms.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.