# Pass SC-300 Identity and Access Administrator: Plan and Entra Labs

> Prepare for the SC-300 Identity and Access Administrator exam using the October 28, 2026 skills measured: domain weights, a four-week plan and hands-on Microsoft Entra labs.

Source: https://www.epifive.com/blog/sc-300-study-guide-identity-access-administrator · Published 2026-10-25 · EpiFive

## Key takeaways

- SC-300 certifies the Identity and Access Administrator Associate role and is built around Microsoft Entra, not Active Directory alone.
- The skills outline has four domains, each between 20 and 30 percent, so balanced preparation beats deep study of one area.
- The English exam updates on October 28, 2026, with minor changes to authentication, Global Secure Access and privileged access.
- Most objectives are tasks you perform in a tenant, so lab time in Conditional Access, PIM, app registrations and entitlement management matters more than reading.
- The exam lasts 100 minutes, needs 700 or more to pass, and the certification renews free every 12 months.

SC-300 is the exam for the Microsoft Certified: Identity and Access Administrator Associate certification, and the most reliable way to prepare is to work through the four domains in Microsoft's skills outline in a practice tenant: user identities, authentication and access management, workload identities, and identity governance. Each domain is worth roughly a fifth to a third of the exam, so spread your time across all of them. This guide uses the skills measured that take effect on October 28, 2026.

## Who this is for and what you will have at the end

This guide is for IT administrators who manage Microsoft Entra ID day to day and want a credential, for help desk and systems staff moving into identity work, and for current SC-300 holders who need to see what the update changes. By the end you will have the exam facts, a domain-by-domain checklist, a four-week schedule and a list of labs that map to the objectives.

Microsoft describes the candidate as someone who designs, implements and operates identity and access management with Microsoft Entra, configures identities throughout their lifecycles for users, devices, Azure resources and applications, and applies Zero Trust principles. The audience profile also expects familiarity with Azure, Microsoft 365 services and workloads, Active Directory Domain Services (AD DS), PowerShell and Kusto Query Language (KQL).

## Exam facts to confirm first

The facts below come from the official SC-300 certification page and study guide, both read on October 25, 2026. Check them again before you book, because Microsoft revises exams periodically.

| Item | Value |
| --- | --- |
| Certification | Microsoft Certified: Identity and Access Administrator Associate |
| Level | Intermediate |
| Passing score | 700 or greater |
| Time allowed | 100 minutes |
| Delivery | Proctored through Pearson VUE; may include interactive components |
| Retake after a fail | 24 hours after the first attempt; later retakes vary |
| Renewal | Every 12 months, free, by passing an online assessment on Microsoft Learn |
| Languages | English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), Chinese (Simplified), Chinese (Traditional) |
| Skills outline date | Skills measured as of October 28, 2026 |

Two practical notes from the Microsoft pages. First, Microsoft recommends registering for exams with a personal Microsoft account rather than a work or school account, because exam records tied to an organizational account are lost if you leave the organization. Second, the English exam is updated first and localized versions follow about eight weeks later; if your language is not offered, the study guide says you can request an extra 30 minutes.

### What the October 28, 2026 update changes

The study guide's change log compares the previous and current skills measured. It marks three areas as "Minor" changes: plan, implement and manage Microsoft Entra user authentication, implement Global Secure Access, and plan and implement privileged access. The audience profile and the other areas are marked "No change". The log does not itemize which bullets moved, so treat the current outline as the source of truth and read third-party notes with their publication date in mind.

Microsoft also says most questions cover features that are generally available, but the exam may include Preview features that are commonly used. Each bullet in the outline illustrates how a skill is assessed, and related topics may appear.

## Skills measured, domain by domain

The outline lists four domains. The percentages below are from the study guide's "Skills at a glance" list. One caution: the heading for the authentication domain further down the same page shows 20-25 percent, while the summary list shows 25-30 percent. Because the figures conflict, plan for authentication to be at least as heavy as the other three.

| Domain | Weight |
| --- | --- |
| Implement and manage user identities | 20-25% |
| Implement authentication and access management | 25-30% |
| Plan and implement workload identities | 20-25% |
| Plan and automate identity governance | 20-25% |

### Implement and manage user identities

This domain has four objective groups.

- **Configure and manage a Microsoft Entra tenant.** Built-in and custom Entra roles, when to use administrative units and how to manage them, evaluating effective permissions, domains in Entra ID and Microsoft 365, company branding, and tenant, user, group and device settings.
- **Create, configure and manage identities.** Users, groups, custom security attributes, bulk operations through the admin center and PowerShell, device join and registration, and assigning, modifying and reporting on licences.
- **External users and tenants.** External collaboration settings, inviting guests individually or in bulk, managing external accounts, cross-tenant access settings, cross-tenant synchronization, and external identity providers using protocols such as SAML and WS-Fed.
- **Hybrid identity.** Microsoft Entra Connect Sync, Cloud Sync, password hash synchronization, pass-through authentication, seamless single sign-on, migrating from AD FS, and Microsoft Entra Connect Health.

Related reading on this site: [Least-privilege Entra admin roles](https://www.epifive.com/blog/entra-admin-roles-least-privilege) for the roles objectives, and [Entra Cloud Sync vs Connect Sync](https://www.epifive.com/blog/entra-cloud-sync-vs-connect-sync) for the hybrid group.

### Implement authentication and access management

- **User authentication.** Planning authentication, managing authentication methods including certificate-based authentication, Temporary Access Pass, Microsoft Authenticator and passkeys (FIDO2), tenant-wide MFA settings, self-service password reset (SSPR), Windows Hello for Business, disabling accounts and revoking sessions, Entra password protection, and Entra Kerberos authentication for hybrid identities.
- **Conditional Access.** Planning policies, assignments, controls, testing and troubleshooting, session management, device-enforced restrictions, continuous access evaluation, authentication context, protected actions, and creating a policy from a template.
- **Identity Protection.** User risk and sign-in risk through Identity Protection or Conditional Access, MFA registration through authentication methods and registration campaigns, and investigating risky users, sign-ins and workload identities.
- **Global Secure Access.** Deploying the clients, Microsoft Entra Private Access, Microsoft Entra Internet Access, and the Microsoft traffic profile for Microsoft 365.

Conditional Access is the topic where hands-on time pays back fastest. Start with [Break-glass accounts and Conditional Access](https://www.epifive.com/blog/conditional-access-break-glass-accounts) so you do not lock yourself out of a practice tenant.

### Plan and implement workload identities

- **Identities for applications and Azure workloads.** Choosing between managed identities, service principals, user accounts and managed service accounts; creating a managed identity, assigning it to an Azure resource and using it to reach other resources.
- **Enterprise applications.** Application-level and tenant-level settings, roles for managing enterprise apps, Application Proxy for on-premises apps, SaaS integration, assigning users, groups and app roles, user and admin consent, and application collections.
- **App registrations.** Planning, creating, configuring authentication, API permissions and app roles.
- **Defender for Cloud Apps.** Cloud discovery, connected apps, application-enforced restrictions, Conditional Access app control, access and session policies, OAuth app policies and the cloud app catalog.

### Plan and automate identity governance

- **Entitlement management.** Planning entitlements, catalogs, access packages, access requests, terms of use, the lifecycle of external users and connected organizations.
- **Access reviews.** Planning, creating and configuring reviews, monitoring activity and manually responding.
- **Privileged access.** Entra roles and Azure resources in Privileged Identity Management (PIM), PIM for Groups, request and approval processes, audit history and reports, and emergency access accounts.
- **Monitoring.** Sign-in, audit and provisioning logs; diagnostic settings with Log Analytics, storage accounts and Event Hubs destinations; KQL in Log Analytics; workbooks; and Identity Secure Score.

For the governance domain, [PIM for Groups and access reviews](https://www.epifive.com/blog/pim-for-groups-access-reviews) covers two objective groups in one practical walkthrough.

## A four-week study plan

Adjust the pace to your experience. The order starts with the tenant foundation, because later labs depend on having users, groups and licences in place.

| Week | Focus | Outcome |
| --- | --- | --- |
| 1 | User identities, external identities and hybrid concepts | Custom domain, users and groups, an administrative unit, guest invitations, cross-tenant settings reviewed, and a written comparison of Connect Sync and Cloud Sync |
| 2 | Authentication methods and Conditional Access | Methods enabled and tested, SSPR configured, a Conditional Access policy created from a template and tested with What If |
| 3 | Identity Protection, workload identities and enterprise apps | Risk policies reviewed, a managed identity used from an Azure resource, an app registration with API permission and an app role, consent settings changed |
| 4 | Governance, monitoring and practice assessment | An access package, an access review, PIM assignments, diagnostic settings, KQL queries on sign-in logs, and the free practice assessment |

Begin each week by reading the matching bullets in the study guide and end it by ticking them off. If you cannot say where a setting lives in the portal or what it changes, you are not ready on that bullet. Global Secure Access spans the authentication domain, so reserve a short block in week 2 or 4 to read its documentation and, if your licensing allows, deploy a client.

## Labs that map to the objectives

Use a tenant where you are allowed to change settings: a developer or trial tenant, never production. The related post [Microsoft 365 Developer Program sandbox](https://www.epifive.com/blog/microsoft-365-developer-program-sandbox) covers getting one. This guide does not state licence requirements or prices; check Microsoft's current licensing pages for each feature, because Conditional Access, Identity Protection, PIM, entitlement management and Global Secure Access have different requirements.

1. **Tenant foundation.** Add a custom domain if you own one, set company branding, create users and groups, create an administrative unit and assign a scoped role, and review the user, group and device settings pages.
2. **Bulk operations.** Create several users from a CSV through the admin center bulk operation, then repeat with PowerShell so you recognize both routes.
3. **External collaboration.** Invite a guest, change external collaboration settings, and open cross-tenant access settings to see the inbound and outbound defaults.
4. **Authentication methods.** Enable Temporary Access Pass and passkeys (FIDO2) for a test group, register a method with a test user, and configure SSPR for the same group.
5. **Conditional Access.** Create a policy from a template in report-only mode, then use the What If tool to test it against a test user. Then change an assignment and a grant control and note the effect.
6. **Identity Protection.** Review the risky users and risky sign-ins reports and the registration campaign settings, even if the tenant has no risk data.
7. **Managed identity.** Enable a managed identity on an Azure resource such as a virtual machine or function app and grant it a role on a storage account, then use it to access the account.
8. **App registration and consent.** Register an application, add an API permission, create an app role, and review the user consent and admin consent settings under enterprise applications.
9. **Entitlement management.** Create a catalog and an access package with an approval step, request it as a test user, and observe the lifecycle.
10. **Access reviews and PIM.** Create an access review for a group, make a role assignment eligible in PIM, activate it, and read the audit history.
11. **Monitoring.** Configure diagnostic settings to send sign-in and audit logs to a Log Analytics workspace, then run KQL against the results.

## KQL practice for the monitoring objectives

The outline expects you to monitor Entra ID with KQL in Log Analytics, and the audience profile lists KQL as a prerequisite. The `SigninLogs` table is the Microsoft Entra sign-in table in Azure Monitor Logs, and a `ResultType` of 0 means a successful sign-in. These queries return data only after you configure diagnostic settings for sign-in logs and some time has passed.

Count failed sign-ins by user over the last day:

```kusto
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by UserPrincipalName
| sort by Failures desc
```

Break failures into hourly bins to see whether they cluster:

```kusto
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by bin(TimeGenerated, 1h)
| sort by TimeGenerated asc
```

For a deeper walkthrough of the logging setup, see [Send Entra sign-in and audit logs to Log Analytics](https://www.epifive.com/blog/entra-logs-log-analytics-retention).

## Common preparation mistakes

- **Studying from an outdated outline.** The update on October 28, 2026 changes authentication, Global Secure Access and privileged access. Always check the date at the top of the skills measured section.
- **Reading about Conditional Access without testing it.** The outline names testing and troubleshooting. Use report-only mode and the What If tool until the evaluation logic is familiar.
- **Ignoring governance.** Entitlement management, access reviews and PIM together make up a fifth or more of the exam, and they are features many administrators never open in daily work.
- **Treating workload identities as developer topics.** Managed identities, app registrations, consent and Application Proxy are all in the administrator's scope.
- **Skipping the practice assessment.** Microsoft says practice assessments show the style, wording and difficulty of questions. Take it in week 4, review each wrong answer against the study guide and repeat the related lab.

## Exam-day checklist

- Confirm the exam appointment, the identification required by Pearson VUE and whether you are testing online or at a centre.
- Register with a personal Microsoft account so your records survive a job change.
- Use the exam sandbox once to see the interface and the question types.
- Plan your pace for 100 minutes: answer what you know first, and leave time to review.
- Afterwards, set a reminder to renew: the certification lasts 12 months and renewal is a free online assessment on Microsoft Learn.

## Summary

SC-300 rewards administrators who have actually configured Entra: roles and administrative units, authentication methods, Conditional Access, app registrations and consent, entitlement management, access reviews and PIM. Use the October 28, 2026 outline as your checklist, give each of the four domains steady attention, finish with the free practice assessment, and confirm exam details on the Microsoft pages before you book.

## References

- Microsoft Certified: Identity and Access Administrator Associate: https://learn.microsoft.com/en-us/credentials/certifications/identity-and-access-administrator/
- Study guide for Exam SC-300: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-300
- Exam duration and exam experience: https://learn.microsoft.com/en-us/credentials/support/exam-duration-exam-experience
- Exam retake policy: https://learn.microsoft.com/en-us/credentials/support/retake-policy
- SC-300 free practice assessment: https://learn.microsoft.com/en-us/credentials/certifications/exams/sc-300/practice/assessment?assessment-type=practice&assessmentId=60

## Frequently asked questions

### How long is the SC-300 exam and what is the passing score?

The Microsoft Learn certification page says you have 100 minutes to complete the assessment, and the study guide says a score of 700 or greater is required to pass. The exam is proctored and may include interactive components.

### Which SC-300 domains carry the most weight?

Implement authentication and access management is listed at 25-30 percent. The other three domains, user identities, workload identities and identity governance, are each 20-25 percent, so no single area can be skipped.

### Is SC-300 changing soon?

Yes. Microsoft says the English version is updated on October 28, 2026. The change log marks minor changes to user authentication, Global Secure Access and privileged access, and no change to the other areas. Localized versions are updated about eight weeks after English.

### Can I retake SC-300 if I fail, and how do I renew it?

You can retake a failed exam 24 hours after the first attempt; later retakes wait varying times. The certification renews every 12 months at no cost by passing an online assessment on Microsoft Learn.