EnglishDeutschFrançaisEspañolPortuguês

Microsoft · SC-300 · Associate

Microsoft Identity and Access Administrator (SC-300) — Practice Questions and Mock Exam

The SC-300 certification validates skills in designing, implementing, and operating an organization's identity and access management using Microsoft Entra.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing SC-300 freeBuy SC-300 access for $29.99
50Questions per Pass-IT mock exam
100minPass-IT mock exam time limit

Official SC-300 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a SC-300 sample question and read the explanation with its source. Right here, with no sign-up.

Plan and automate identity governance1 / 5

You are configuring PIM for Groups in the Microsoft Entra admin center. Your organization wants just-in-time access to Microsoft Entra roles via groups. For each of the following statements, select Yes if the statement is true. Otherwise, select No. 1. PIM for Groups allows just-in-time activation of both group membership and group ownership. 2. Role-assignable groups can have other groups nested inside them as active members. 3. PIM for Groups can provide just-in-time access to Azure roles, Key Vault, Intune, and third-party applications. 4. For roles with SharePoint/Exchange permissions, Microsoft recommends active user-to-group assignments with eligible group-to-role assignments.

AlexFull explanation from Alex

PIM for Groups enables just-in-time activation of both group membership and group ownership (docs.microsoft.com/entra/id-governance/privileged-identity-management). Statement 1: Yes — PIM for Groups supports JIT membership and ownership activation. Statement 2: No — role-assignable groups cannot have other groups nested inside them as active members per Microsoft Learn docs. Statement 3: Yes — PIM for Groups provides JIT access to Microsoft Entra roles, Azure roles, Azure SQL, Azure Key Vault, Intune, and third-party applications. Statement 4: Yes — for roles with SharePoint/Exchange permissions, Microsoft recommends active user-to-group assignments with eligible group-to-role assignments to avoid activation delays, since SharePoint/Exchange do not support real-time propagation of JIT membership. Exam tip: PIM for Groups = JIT membership + ownership. Role-assignable groups cannot nest groups. Use active user-to-group for SharePoint/Exchange roles.

Sourcelearn.microsoft.com

Plan and implement workload identities3 / 5

You need to configure Microsoft Entra ID to prevent deleted applications from being permanently lost. What is the retention period for soft-deleted applications?

AlexFull explanation from Alex

Soft-deleted applications in Microsoft Entra ID are retained for 30 days. Per Microsoft Learn (Deletion and recovery of applications FAQ): soft-deleted application and service principal objects go into the deleted items container and remain available to restore for up to 30 days. After 30 days, they are permanently deleted, freeing the quota. Both app registrations and their corresponding service principals follow the same 30-day lifecycle. Administrators with Cloud Application Administrator or Application Administrator roles can restore within this window. Exam tip: 30-day retention period for soft-deleted apps. Permanent deletion after window. Restorable by admins during retention.

Sourcelearn.microsoft.com

Implement and manage user identities4 / 5

Contoso collaborates with Fabrikam, which has its own Microsoft Entra tenant and enforces MFA for all employees. A Contoso Conditional Access policy requires MFA for guest users, so Fabrikam guests are asked to register MFA again in Contoso. You need Fabrikam guests to satisfy the Contoso policy with the MFA they completed in Fabrikam. What should you configure in the Contoso tenant?

AlexFull explanation from Alex

Cross-tenant access settings have inbound settings, which govern how external users reach your resources, and outbound settings, which govern how your users reach other tenants. Inside the inbound settings, the trust settings decide whether your Conditional Access policies accept MFA and device claims issued by the other Microsoft Entra tenant. With Trust multifactor authentication from Microsoft Entra tenants enabled for Fabrikam, Microsoft Entra ID checks the guest's token for a completed-MFA claim and lets that satisfy your policy. External collaboration settings control invitations and guest permissions, and named locations describe networks. Exam tip: guests from a partner tenant are inbound to you, so MFA trust is an inbound trust setting configured in the resource tenant.

Sourcelearn.microsoft.com

How to prepare for SC-300 with Pass-IT.

Currently 352 practice questions for SC-300, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Try the available questions in the preview above.

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Try the available questions in the preview above.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your SC-300 mock exam

Questions
50
Minutes
100

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for SC-300.

Exam topics, relevant practice and sources you can check.

User and tenant identities20–25% of the exam63 QuestionsPass-IT questions

You manage identities across Microsoft Entra, partner organizations and on-premises directories.

  • Configure tenant settings, domains, branding, roles and administrative units, and evaluate the permissions those roles actually grant.
  • Create and manage users, groups, security attributes, device join and registration and licenses, and automate bulk identity operations with the admin center and PowerShell.
  • Invite and manage external users, configure collaboration and cross-tenant access and synchronization, and connect external identity providers.
  • Implement and monitor hybrid identity with Entra Connect Sync, Cloud Sync and Connect Health; configure hybrid sign-in methods and migrate authentication away from AD FS.
Official Microsoft objectives
Authentication and access controls20–25% of the exam138 QuestionsPass-IT questions

You configure sign-in methods and decide when access should be allowed, restricted or revoked.

  • Plan and implement authentication methods, multifactor authentication, self-service password reset, Windows Hello and hybrid Kerberos; protect passwords, disable accounts and revoke sessions when needed.
  • Build, test and troubleshoot Conditional Access policies with assignments, controls, session and device restrictions, continuous evaluation, authentication context and protected actions.
  • Configure user and sign-in risk policies and authentication registration campaigns, then monitor, investigate and remediate risky users, sign-ins and workload identities.
  • Deploy Global Secure Access clients and manage Private Access, Internet Access and access to Microsoft 365 services.
Official Microsoft objectives
Application and workload identities20–25% of the exam68 QuestionsPass-IT questions

You give applications the identities and permissions they need and monitor their access.

  • Choose suitable workload identities, create and assign managed identities, and use them to access other Azure resources.
  • Integrate local and SaaS applications, including Entra Application Proxy, and manage enterprise-app settings, administrative roles, assignments, consent and application collections.
  • Plan and create app registrations, configure authentication and API permissions, and define app roles.
  • Discover and connect cloud apps in Defender for Cloud Apps, then control access and sessions with application restrictions, Conditional Access, OAuth policies and the cloud app catalog.
Official Microsoft objectives
Identity governance and monitoring20–25% of the exam83 QuestionsPass-IT questions

You manage access throughout its lifecycle and review how identities are used.

  • Plan and implement entitlement management with catalogs, access packages, requests and terms of use, including connected organizations and the lifecycle of external users.
  • Plan and configure access reviews, monitor their progress and act on review results.
  • Configure Privileged Identity Management for Entra roles, Azure resources and groups, manage approvals and audit history, and maintain emergency access accounts.
  • Analyze sign-in, audit and provisioning logs, route diagnostics to suitable destinations, use KQL and workbooks, and improve identity security with Identity Secure Score.
Official Microsoft objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are Pass-IT practice formats. Check the Microsoft certification page for the official exam information.

The ranges describe the weighting of exam topics. See Official Microsoft objectives for the current exam objectives.

Frequently asked questions

Your preparation

How much study time should I plan for SC-300?

For planning, Pass-IT estimates roughly 30–75 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Do you need SC-900 before SC-300?

No, Microsoft sets no prerequisite. SC-900 is a fundamentals exam covering security, compliance and identity concepts, so it helps if Entra ID is new ground and adds little if you already administer it. The catalog budget for SC-300 is around 50 hours.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam.

How long does my SC-300 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the SC-300 exam

Where can I take the SC-300 exam?

Pearson VUE online proctored or at authorized testing centers worldwide.

How long is the Microsoft Identity and Access Administrator exam?

The SC-300 exam has 50 questions and a 100-minute time limit.

How long does SC-300 stay valid?

One year from the pass date. Microsoft renews it through a free online assessment on Microsoft Learn that opens six months before expiry. Because Entra ID changes continuously, the assessment tends to cover features that did not exist when you sat the exam.

Your preparation for SC-300

$29.99one-time

12 months of access for SC-300 · No automatic renewal

Buy SC-300 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →