SC-300: Microsoft Identity and Access Administrator

Demonstrate how to create a conditional access policy to block downloads for user A in SharePoint Online, enforcing Azure AD joined or compliant devices to allow downloads.

Explore passwordless SMS-based authentication in Azure AD by creating a new user, assigning a license, and enabling SMS as a sign-in method, then test with a phone number on Office.com.

Enable per-user MFA with the Microsoft Authenticator app on Android and iOS, enabling passwordless sign-in and approvals to secure Azure Active Directory logins.

Demonstrates passwordless sign-in with the Microsoft Authenticator app as the primary authentication method, including device registration with Azure AD, screen lock, and signing in without a password.

Demonstrates configuring security key authentication in Azure Active Directory, enabling passwordless sign-in with a USB security key, setting up a key with a pin and fingerprint, and testing login.

Review the lifecycle of multi-factor authentication, from disabled to enabled to enforced, and explore per-user MFA, IP exemptions, legacy protocols, location-based controls, and passwordless options.

Demonstrate delegated access by showing how a logged-in user’s permissions govern resource access in Azure AD and the Graph API, contrasted with application permissions in a dotnet web app.

Set up delegated access to a storage account by creating a container, uploading a file, and assigning Azure AD roles such as reader and storage blob data reader.

Demonstrates implementing delegated access in a .NET app to read Azure storage using user impersonation. Configure an Azure AD application object, grant storage delegated permissions, and complete the consent flow.

Explore the Azure Monitor service, including the activity log for control plane activities, and create alerts from queries in a log analytics workspace based on resource metrics like CPU utilization.

Create an alert from sign-in logs in a log analytics workspace by filtering result types not zero, then configure a threshold-based alert rule and an action group for email.

Discover Azure AD workbooks to visualize sign-in data, including successful, pending, and failed events, by location and device. See built-in workbooks and learn to create your own for directory insights.

Export sign in logs to json or csv to determine if conditional access was applied. Use json-based logs to view the applied policy name and details in a structured format.

Explore the Azure sentinel service, a SIEM and SOAR platform that collects sign-in data from Azure Active Directory, detects threats with rules, and automates responses within the log analytics workspace.

Understand break-glass and emergency accounts in Azure, including a plain, permanently assigned account not tied to any user, with multi-factor authentication and an authentication method from the primary global administrator.

Explore how to synchronize on-premises identities to Azure Active Directory with Azure AD Connect, configure password hash synchronization or pass-through authentication, and publish on-prem apps via Application Proxy.

Assign licenses to users or groups on Azure AD, choosing Azure AD premium licenses for conditional access and identity protection, or Microsoft 365 licenses for Exchange Online and SharePoint Online.

Explore the types of groups in Azure Active Directory, including security and Microsoft 365 groups, and how cloud and on-premises users join, with dynamic groups for automatic licensing.

Enforce global and custom banned password lists with azure ad password protection, blocking obfuscated passwords. Extend protection on-prem with the password protection proxy and dc agent on a domain controller.

Examine conditional access policies, including filtering users and groups, and creating rules by name and location. Configure multi-factor authentication enforcement, block older authentication protocols, and manage access from high-risk locations.

Retain Azure Active Directory sign-in and audit logs with diagnostic settings. Leverage Log Analytics and Azure Sentinel data connectors to detect threats and monitor apps, including Defender for cloud apps.

Review user access across groups, applications, Azure AD roles, and RBAC roles with access reviews. Automate access with entitlement management packages, enabling cross-tenant restrictions and streamlined provisioning.