SC-300 Domains Explained With Examples

The short version

SC-300 has four domains of similar size. The names and weightings below come from Microsoft’s study guide, “Skills measured as of October 28, 2026”. The traps and practice advice are our own experience-based commentary, not vendor statements. Microsoft also notes that the bullets under each skill illustrate how it is assessed, and related topics may appear.

Domain	Weighting
Implement and manage user identities	20-25%
Implement authentication and access management	25-30%
Plan and implement workload identities	20-25%
Plan and automate identity governance	20-25%

The study guide shows 25-30% for the second domain in its summary list and 20-25% in the heading of that domain. Treat the second domain as the largest or tied for it.

Domain 1: Implement and manage user identities (20-25%)

What it covers. Four groups of skills.

Tenant configuration: built-in and custom roles, when to use administrative units, effective permissions, domains, company branding, and tenant, user, group, and device settings.
Identities: users, groups, custom security attributes, bulk operations with the admin center and PowerShell, device join and registration, and licenses.
External users and tenants: external collaboration settings, bulk invitations, cross-tenant access settings, cross-tenant synchronization, and external identity providers using SAML or WS-Fed.
Hybrid identity: Entra Connect Sync, Cloud Sync, password hash synchronization, pass-through authentication, seamless single sign-on, migration from AD FS, and Connect Health.

In practice. A regional help desk may reset passwords only for its own region (administrative unit). A partner company needs access to one app (B2B). An on-premises directory must sync to the cloud with the least infrastructure.

Typical traps.

Assigning a role at tenant scope when the requirement limits it to a subset of users.
Choosing Cloud Sync when a requirement (such as merging attributes from several forests) needs Connect Sync, or the reverse when “lightweight agent” is the hint.
Mixing up device join (the device joins the tenant) with device registration (a personal device is known to it).

Practice. Build an administrative unit, run a bulk invite, and read through the configuration choices of both sync tools.

Domain 2: Implement authentication and access management (25-30%)

What it covers.

User authentication: authentication methods (certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, passkeys), tenant-wide MFA, self-service password reset, Windows Hello for Business, disabling accounts and revoking sessions, password protection, and Kerberos authentication for hybrid identities.
Conditional Access: planning, assignments, controls, testing and troubleshooting, session management, device-enforced restrictions, continuous access evaluation, authentication context, protected actions, and policy templates.
ID Protection: user risk, sign-in risk, MFA registration campaigns, and investigating risky users, sign-ins, and workload identities.
Global Secure Access: deploying clients, Private Access, Internet Access, and the Microsoft traffic profile.

In practice. Block legacy sign-ins, require MFA for administrators, force a password change for a high-risk user, or give a new employee a Temporary Access Pass to register a passkey.

Typical traps.

Forgetting what a Conditional Access target actually covers. A policy on one resource does not cover tools that use a different API.
Confusing sign-in risk (remediated by MFA) with user risk (remediated by a secure password change).
Treating report-only mode as enforcement, or skipping it when a question asks how to test safely.

Practice. Build policies in report-only mode and read the sign-in log’s “Conditional Access” tab for each result. Weighting makes this the most valuable domain to master.

Domain 3: Plan and implement workload identities (20-25%)

What it covers.

Identities for apps and Azure workloads: choosing between managed identities, service principals, user accounts, and managed service accounts, and creating and assigning managed identities.
Enterprise applications: settings, roles to manage them, Application Proxy for on-premises apps, SaaS integration, app roles, user and admin consent, and application collections.
App registrations: planning, creating, app authentication, API permissions, and app roles.
Defender for Cloud Apps: cloud discovery, connected apps, application-enforced restrictions, Conditional Access app control, access and session policies, OAuth app policies, and the cloud app catalog.

In practice. A web app reads secrets without a stored password (managed identity). An on-premises intranet app is published to remote users (Application Proxy). A risky OAuth app is blocked.

Typical traps.

Mixing the enterprise application (the instance in your tenant) with the app registration (the definition of the app).
Choosing a service principal with a secret when a managed identity removes the secret.
Mixing up delegated permissions (acting as a signed-in user) with application permissions (acting as the app).

Practice. Create a managed identity, assign it a role, then register an app, add an API permission, and see what admin consent changes.

Domain 4: Plan and automate identity governance (20-25%)

What it covers.

Entitlement management: catalogs, access packages, access requests, terms of use, lifecycle of external users, and connected organizations.
Access reviews: planning, creating, monitoring, and responding to reviews.
Privileged access: PIM for Entra roles, Azure resources, and groups, the request and approval process, audit history, and emergency access accounts.
Monitoring: sign-in, audit, and provisioning logs, diagnostic settings, KQL in Log Analytics, workbooks, and Identity Secure Score.

In practice. New hires get a bundle of access automatically, contractors lose access when a project ends, and administrators activate roles only when needed, with approval.

Typical traps.

Mixing eligible (activate when needed) and active (always on) assignments in PIM.
Using an access review when the requirement is to grant access, or an access package when the requirement is to recertify it.
Missing the license each feature needs.

Practice. Build an access package with an approval step, set up a review, and write a KQL query that counts failed sign-ins per day.

More guides for SC-300

Next step

Choose the domain where you marked the most red bullets and read the matching Microsoft Learn module, then return to the study plan. When you want questions by domain, our SC-300 practice tests show a score per domain after every attempt.

Frequently asked questions

Which domain is the heaviest?

Authentication and access management, at 25-30% in Microsoft’s summary. The other three are 20-25% each.

Do I need to memorize every setting?

No. Know what each feature is for, which license it needs, and how it differs from its look-alike. Exact click paths matter less than the reasoning.

Are preview features tested?

Microsoft says most questions cover generally available features, and that the exam may include preview features if they are commonly used.

Try the SC-300 practice exams