Microsoft SC-300 Cheat Sheet: Identity and Access

May 1, 2026

Review the Microsoft Identity and Access Administrator (SC-300) scope, Microsoft Entra ID, Conditional Access, MFA, privileged access, app consent, lifecycle, and governance traps before practicing.

On this page

SC-300 is an identity exam. Use this cheat sheet to keep the access-control model clear: who the subject is, what resource is being accessed, which conditions apply, and how Microsoft Entra governance keeps access current.

Use this with practice. Review the identity checkpoints, then return to the SC-300 exam page for sample questions and update tracking.

Open SC-300 practice page Compare Microsoft Security routes

Exam snapshot

Field	Detail
Issuer	Microsoft
Certification lane	Microsoft Identity and Access Administrator
Exam code	SC-300
Main scope	Microsoft Entra identity, authentication, authorization, lifecycle, applications, and governance
IT Mastery status	Sample questions available

Identity map

Area	What to know	Common trap
Authentication methods	MFA, passwordless, registration, method policy, user rollout, and risk-based enforcement	Assuming MFA works before users have registered methods
Conditional Access	User, group, app, device, location, risk, grant controls, and session controls	Applying broad policies without exclusions or break-glass planning
Privileged access	PIM, eligible roles, activation, approval, audit, access reviews, and least privilege	Making privilege permanent because activation feels inconvenient
App access and consent	App registrations, delegated permissions, application permissions, admin consent, and scopes	Treating consent as harmless when it grants tenant data access
External identities	B2B collaboration, guest access, entitlement management, lifecycle, and access reviews	Sharing internal accounts with partners
Identity governance	Access packages, reviews, lifecycle workflows, group governance, and stale-access removal	Only granting access and never reviewing it

Must-know distinctions

Distinction	How to decide
Authentication vs authorization	Authentication proves identity; authorization decides what the identity can do.
MFA vs Conditional Access	MFA is a control; Conditional Access decides when and where controls apply.
Eligible role vs active role	Eligible users can activate a role; active users currently hold the role.
Delegated permission vs application permission	Delegated access acts as a signed-in user; application access acts as the app itself.
Guest access vs external access	Guest access brings an external identity into the tenant; external access enables communication across tenants.
Access review vs access package	Reviews validate existing access; packages bundle access for request and lifecycle management.

High-yield checklist

Identify the identity type: employee, admin, guest, workload, or application.
Check whether the issue is sign-in, consent, role assignment, lifecycle, or governance.
Apply least privilege before broad administrator roles.
Use Conditional Access when the scenario includes risk, device state, location, app, or session conditions.
Use PIM for privileged roles that should not be permanently active.
Use access reviews for stale group, guest, or privileged access.
Use app consent governance when third-party or internal apps request tenant data.
Use passwordless or stronger authentication when reducing password risk is the goal.
Keep break-glass accounts and testing in mind for restrictive policies.

Common traps

Choosing a new group when the real problem is stale access review.
Assigning global administrator for helpdesk tasks.
Ignoring application permissions because no human user is involved.
Applying Conditional Access without considering service accounts or emergency access.
Treating guest access as an unmanaged exception.
Solving a lifecycle problem with one-time manual cleanup only.

Practice strategy

For SC-300 misses, classify the item as authentication, authorization, app consent, privileged access, external identity, or governance. Then explain which Microsoft Entra control changes access over time, not just at the moment of creation.

Revised on Monday, May 25, 2026