SC-300 Cheat Sheet: Key Facts to Review

The short version

This sheet is for review, not for learning from zero. It follows the four domains of Microsoft’s study guide (“Skills measured as of October 28, 2026”), and it is written in our own words. It does not cover everything on the exam, and the study guide is the authority on scope. The decision rules and traps are our commentary, not Microsoft statements. Licensing needs change, so check what your tenant has.

Exam facts at a glance

Item	Detail
Credential	Microsoft Certified: Identity and Access Administrator Associate
Level	Intermediate
Exam time	100 minutes, proctored through Pearson VUE
Passing score	700 on a scale of 1 to 1,000
Questions	Number not published for this exam
Languages	10, including English
Retakes	24 hours, then 14 days; five attempts in 12 months
Renewal	Every 12 months, free online assessment
Domain weights	20-25%, 25-30%, 20-25%, 20-25%

Domain 1: User identities (20-25%)

Look-alike pairs

Role vs administrative unit: a role says what someone can do. An administrative unit says over which users, groups, or devices. Combine them for scoped help desk work.
Restricted management administrative unit vs a normal one: the restricted kind protects its members from tenant-wide administrators, so only assigned administrators can change them.
Device join vs device registration: join is for company-owned devices. Registration is for personal devices that stay personal.
B2B collaboration vs B2B direct connect: collaboration creates a guest in your directory. Direct connect is a mutual trust for shared channels, with no guest object.
Connect Sync vs Cloud Sync: Connect Sync is the full-featured server tool. Cloud Sync uses lightweight agents managed from the cloud and suits simpler or disconnected-forest cases.
Password hash sync vs pass-through authentication: the first copies a hash of the hash to the cloud. The second validates against on-premises Active Directory at sign-in.

Decision rules

Scope is limited to a subset of users: think administrative unit, not a tenant-wide role.
A partner needs one app: think B2B, with cross-tenant access settings to limit it.
“Least infrastructure” in a hybrid scenario: think Cloud Sync or password hash sync.
Bulk work: think the admin center import or PowerShell, not a loop of single edits.

Traps: assigning a role at the wrong scope, forgetting that guests need their own policies, and choosing a tool the scenario’s forest layout cannot use.

Domain 2: Authentication and access (25-30%)

Look-alike pairs

Temporary Access Pass vs password reset: a Temporary Access Pass is a time-limited code for registering other methods, such as a passkey. A reset changes a password.
User risk vs sign-in risk: user risk is the chance the account is compromised, usually fixed with a secure password change. Sign-in risk is the chance this attempt is not the owner, usually fixed with MFA.
Authentication methods vs authentication strengths: methods are what users can use. Strengths are which methods a policy accepts.
Report-only vs enabled: report-only logs what would happen and enforces nothing.
Grant controls vs session controls: grant decides whether access is allowed. Session shapes the session once allowed.
Private Access vs Internet Access: private apps and resources versus web traffic.

Decision rules

“Test safely before enforcing”: report-only mode.
“Require a stronger step for one sensitive action”: authentication context or protected actions.
“End access quickly after a change”: continuous access evaluation and revoking sessions.
“Replace a VPN for private apps”: Entra Private Access.
“Passwordless for a new hire”: Temporary Access Pass to register a passkey or Authenticator.

Traps: a policy aimed at one resource does not cover tools using a different API, treating risk-based policies as free of licensing needs, and locking out all administrators with an over-broad policy.

Domain 3: Workload identities (20-25%)

Look-alike pairs

Enterprise application vs app registration: the enterprise application is the instance in your tenant. The registration is the app’s definition.
System-assigned vs user-assigned managed identity: system-assigned lives and dies with one resource. User-assigned is a separate object that several resources can share.
Managed identity vs service principal with a secret: the first has no credential to store or rotate.
Delegated vs application permissions: acting as a signed-in user versus acting as the app itself.
User consent vs admin consent: admin consent covers the whole organization and is needed for higher-risk permissions.
Access policy vs session policy in Defender for Cloud Apps: one controls entry, the other controls actions during a session.

Decision rules

“No secret in code”: managed identity.
“Publish an on-premises web app without a VPN”: Application Proxy with a connector.
“Limit who can approve app access”: consent settings and admin consent workflow.
“Control what a user does inside an app”: Conditional Access app control with a session policy.

Traps: looking in the wrong place for a setting (registration versus enterprise application), and picking application permissions when a user should be the actor.

Domain 4: Identity governance (20-25%)

Look-alike pairs

Catalog vs access package: a catalog groups resources. An access package bundles what a role needs, with rules for who can request it.
Entitlement management vs access reviews: one grants access on request. The other recertifies existing access.
Eligible vs active (PIM): eligible means you activate it when needed. Active means it is on.
PIM for roles vs PIM for groups: roles are directory or Azure roles. Groups allow time-bound membership or ownership of a group.
Sign-in logs vs audit logs vs provisioning logs: who signed in, what changed, and what synced to an app.

Decision rules

“Access that ends on its own”: access package expiration or a review.
“Admins use rights only when needed”: PIM with approval, justification, or MFA on activation.
“Query logs over a long time”: diagnostic settings to a Log Analytics workspace, then KQL.
“Cannot sign in even if Conditional Access fails”: emergency access accounts. Keep at least two, cloud-only, not tied to a person, tightly monitored.

Traps: mixing granting with reviewing, forgetting the license for governance features, and setting an approver who is not allowed to approve.

Last-day checklist

Re-read the weights and skim your red bullets only.
Say aloud, from memory, the pairs in this sheet.
Review your last practice attempt’s wrong answers, not new material.
Check ID, the check-in steps, and your time zone. See the exam day guide.
Sleep. A rested mind beats one more hour of reading.

More guides for SC-300

Next step

Go deeper on any domain in domains explained, then test yourself with the sample questions. Back at the start, the SC-300 overview has the format. Our SC-300 practice tests are original practice sets with a score per domain.

Frequently asked questions

Is this enough to pass?

No. It is a memory aid. Use Microsoft’s study guide for scope and hands-on practice for skill.

Do I need to memorize menu paths?

Mostly no. Know what each feature is for, what separates it from its look-alike, and what the scenario’s constraint points to.

Try the SC-300 practice exams