SC-300 Case Studies: Identity and Access Admin Exam Prep

Walk through the full Fabrikam Healthcare case study — a hybrid hospital network dealing with shared ward workstations, ungoverned Global Admin access, and a partner merger that needs proper external identity governance. You'll see the complete company background, existing environment, and Business/Security/Technical Requirements very similar to style of the real exam, followed by 8 exam-style questions covering PIM break-glass configuration, phishing-resistant MFA, hybrid SSPR with writeback, and dynamic group design.

As well as some tips and tricks that I wish I knew before attempting the exam

Work through the Contoso Financial Services case study — an investment bank responding to a credential-theft incident, a stale contractor account, and a lack of automated risk response. This case study leans into Conditional Access risk-based policies, PIM activation hour limits, insider risk integration with Purview, and the classic "check your existing licence before buying more" trap that shows up repeatedly on the real exam.

Work through the Alpine University case study — a research university juggling three very different types of external relationships: permanent government research partners, project-based corporate sponsors, and public online students. This case study is built specifically to test whether you can tell apart the three external identity mechanisms Microsoft loves to blur together on the exam — B2B invitation, Cross-Tenant Synchronization, and Entitlement Management access packages — plus Terms of Use enforcement via Conditional Access and Access Review configuration for guest governance at scale.

Work through the Pacific Government Agency case study — a government department replacing a flat-network VPN with Zero Trust Network Access after repeated lateral-movement incidents. This case study is heavily focused on Global Secure Access, new content that trips up a lot of SC-300 candidates: Private Access vs. Internet Access, the connector's outbound-only architecture, Remote Network Connectivity for branch offices, and the Compliant Network Conditional Access condition. It also drills the classic exam trap of number matching versus genuine phishing-resistant MFA, and the difference between single-factor and multi-factor certificate-based authentication.

Work through the Northwind Retail Group case study — a 28,000-employee retail chain with 35% annual turnover, drowning in stale accounts and manual identity processes their 8-person IT team can't keep up with. This case study is built around one core exam lesson: at scale, manual solutions always fail. You'll drill dynamic group design, group-based licensing, Workday SCIM provisioning, SSPR with Conditional Access enforcement, and the classic exam trap where dynamic groups alone don't actually prevent privilege creep — Lifecycle Workflows with a remove-before-assign sequence are what the exam wants instead.

Work through the Southland Manufacturing case study — a 12,000-employee industrial manufacturer stuck on an unreliable AD FS farm that's caused three separate Microsoft 365 outages. This case study is entirely about hybrid identity migration done correctly: why Password Hash Sync beats Pass-Through Authentication for both resilience and Identity Protection, how Staged Rollout lets you pilot cloud authentication without converting the domain, Seamless SSO for shared factory workstations, and the exact migration sequence the exam expects — PHS, then Seamless SSO, then Staged Rollout, then app migration, then domain conversion, and AD FS decommissioning last.

Work through the Tailwind Traders case study — an e-commerce platform with 67 apps hardcoding client secrets in source code and 34 apps carrying excessive API permissions. This case study covers the full breadth of Domain 3, the most conceptually distinct part of SC-300: the Managed Identity hierarchy (Azure-hosted workloads always use Managed Identity first, Key Vault second, never a hardcoded secret), the delegated-versus-application permission distinction that trips up almost everyone the first time, SCIM provisioning for SaaS gallery apps, when Application Proxy is the right call over Global Secure Access, and where Workload Identities Premium licensing fits into service principal risk monitoring.

Work through the BlueSky Media Group case study — a media company that deployed Microsoft 365 Copilot to all staff with zero governance, and paid for it within two weeks: a junior employee summarised a confidential acquisition document via inherited SharePoint access, a contractor leaked a talent contract through Copilot output, and 340 staff were caught using personal ChatGPT accounts. This is genuinely new SC-300 exam content, built around one core principle: Copilot inherits the user's permissions — fix the permissions, not Copilot. You'll drill Purview sensitivity labels for content protection, Conditional Access for blocking guest Copilot access, GSA Internet Access for shadow AI, and Microsoft Entra Verified ID for freelance identity verification without creating internal accounts.

Work through the Woodgrove Health Network case study — a hospital system that hasn't run a single access review in 18 months, with 2,800 clinical accounts of uncertain legitimacy and 340 external partner users on direct group membership instead of proper entitlement packages. This case study drills Access Review configuration at genuine scale (reviewer type, fallback reviewers, auto-apply logic), Connected Organizations and access packages for healthcare partner governance, GSA Internet Access for clinical device web filtering, the correct order for Identity Secure Score remediation, and writing actual KQL queries against SignInLogs and AuditLogs to detect impossible travel and off-hours privileged activation.

WELCOME TO THE FINAL BOSS (Case Study #10)

In this ultimate capstone case study, we tackle Meridian Group—an 18,000-employee global enterprise facing a 90-day CISO mandate following three major security incidents.

Unlike previous single-domain studies, Case Study #10 integrates ALL FOUR SC-300 exam domains simultaneously into a realistic, high-stakes enterprise scenario.

---

WHAT YOU WILL LEARN & MASTER IN THIS VIDEO:

• Domain 1 (Identity & Access): Cross-Tenant Synchronization for acquisitions (TechVentures) and automated Leaver Lifecycle Workflows triggered on employeeLeaveDateTime.

• Domain 2 (Authentication & Access Control): Eliminating MFA fatigue, blocking high-risk sign-ins via modern Conditional Access, and securing remote workers with Global Secure Access (GSA).

• Domain 3 (Workload Identities & Governance): Transitioning 23 compromised Azure apps from hardcoded credentials to Managed Identities and Azure Key Vault.

• Domain 4 (Privileged Access & M365 Governance): Configuring PIM for Global Admins, protecting break-glass accounts, governing Copilot with Purview sensitivity labels, and blocking shadow IT via GSA Internet Access.

---

KEY EXAM PATTERNS COVERED:

1. Cross-Tenant Sync = Internal/Acquisition member appearance at scale.

2. Lifecycle Workflows = employeeLeaveDateTime trigger for automated 1-hour offboarding.

3. Legacy ID Protection Portal = WRONG when technical requirements specify modern CA policies.

4. Workload Identity Rule = Azure-hosted → Managed Identity; External/Unsupported → Key Vault.

5. PIM Break-Glass Standard = EXACTLY 2, permanent, .onmicrosoft.com, excluded from ALL CA.

6. Copilot Protection = Guest blocking via CA Policy + Document protection via Purview Sensitivity Labels.

---

PRACTICE RESOURCES:

Be sure to pause the video at each question to attempt the scenario yourself before reviewing the GIDEON answer breakdown and pattern explanation!