SC-300 - Implement and Manage User Identities (25% of the exam) - Section 1.1

Configure and manage a Microsoft Entra tenant, including roles, administrative units, domains, and tenant settings.

Describe built-in and custom Microsoft Entra roles, administrative units, effective permissions, custom domains, Company branding, and tenant-wide settings. Distinguish which scope - tenant, administrative unit, or resource - a role assignment targets and how that affects access.

built-in and custom Microsoft Entra rolesadministrative unitseffective permissionscustom domainsCompany brandingtenant, user, group, and device settings

Practice question for this objective

Free sampleImplement and Manage User Identitiesmedium

An organisation needs a set of administrators who can do exactly one thing: read and update the mobile phone and office location attributes on user profiles. No built-in Microsoft Entra role matches this narrow capability, and the security team insists the administrators get nothing beyond these two attribute permissions. Which approach grants this precise capability with the least privilege?

AAssign the built-in User Administrator role, which already includes permission to update user profile attributes for the targeted users.
BPlace the administrators in a dynamic group and grant that group write access to the user objects through group membership rules.
CAssign the built-in Directory Writers role, which permits editing of selected directory objects across the tenant.
DCreate a custom Microsoft Entra role containing only the user property update permissions, then assign that custom role to the administrators. Correct

Use a custom Microsoft Entra role to grant only the specific directory permissions a task needs when no built-in role matches. Custom roles are built from individual permission sets, so an administrator can include only the user property update actions and exclude everything else. Built-in roles bundle fixed permission groups that cannot be trimmed, which inevitably over-grants when the requirement is a single narrow capability.

Why A is wrong: User Administrator does let holders edit profile attributes, which is why it looks sufficient, but it also grants account creation, deletion and password reset, far exceeding the two-attribute scope the team mandated.

Why B is wrong: Dynamic groups automate membership from attributes and do not confer directory write permissions at all, so this neither scopes nor grants the attribute editing the team requires.

Why C is wrong: Directory Writers sounds like a tidy fit because of its name, but it grants a broad fixed set of write actions across many object types rather than the two specific user attributes requested.

Why D is correct: Custom roles let you compose a role from individual directory permissions, so granting only the user property update actions delivers exactly the two-attribute capability with nothing extra, satisfying least privilege.

See more SC-300 practice questions, answers explained.

Exam traps in Implement and Manage User Identities

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-300 bank for this domain.

Assign the Groups Administrator role to every employee so group creation is centrally governed through that role.
Why it is wrong: Groups Administrator does govern group management, which makes it sound relevant, but assigning it to everyone would broaden creation rights rather than remove them from ordinary employees.
Assign the Global Administrator role, then instruct the administrators not to open the Conditional Access or role assignment blades in the portal.
Why it is wrong: Global Administrator grants full control over every directory feature, so relying on a verbal instruction rather than a permission boundary violates least privilege and still allows policy and role changes.
The group must be converted to a distribution group first, because only mail-enabled distribution groups can hold Microsoft Entra built-in role assignments.
Why it is wrong: Distribution groups are for email distribution and cannot be assigned directory roles at all, so converting the group would remove rather than add the capability.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.