Ultimate Guide to SC-300 Dumps – Enhance Your Future Career Now [Q84-Q103]

SC-300 Microsoft

admin -

July 25, 2026

5/5 - (1 vote)

[Jul 25, 2026] Microsoft Dumps – Learn How To Deal With The (SC-300) Exam Anxiety

DEMO FREE BEFORE YOU BUY SC-300 DUMPS

Microsoft SC-300 certification exam is an important credential for professionals who work in identity and access management. SC-300 exam measures the candidate’s ability to design, implement, and manage identity and access solutions in a Microsoft environment. To prepare for the exam, candidates should have a solid understanding of identity and access management concepts and Microsoft technologies. Microsoft Identity and Access Administrator certification can lead to career advancement opportunities and higher salaries.

By passing the SC-300 certification exam, IT professionals demonstrate their expertise in implementing and managing identity and access management solutions in Microsoft environments. Microsoft Identity and Access Administrator certification validates their skills in configuring and managing Azure AD, designing and implementing identity and access solutions, and providing secure access to applications and resources.

QUESTION 84
Your network contains an on-premises Active Directory domain named contoso.com. The domain contains the objects shown in the following table.

You install Azure AD Connect. You configure the Domain and OU filtering settings as shown in the Domain and OU Filtering exhibit. (Click the Domain and OU Filtering tab.)

You configure the Filter users and devices settings as shown in the Filter Users and Devices exhibit. (Click the Filter Users and Devices tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Explanation:

Only direct members of Group1 are synced. Group2 will sync as it is a direct member of Group1 but the members of Group2 will not sync.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-custom

QUESTION 85
You have an Azure AD tenant that contains an access package named Package1 and a user named User1.
Package1 is configured as shown in the following exhibit.

You need to ensure that User1 can modify the review frequency of Package1. The solution must use the principle of least privilege.
Which role should you assign to User1?

Privileged role administrator

User administrator

External Identity Provider administrator

Security administrator

QUESTION 86
You need to configure app registration in Azure AD to meet the delegation requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation
Graphical user interface, text Description automatically generated

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles

QUESTION 87
Your network contains an on-premises Active Directory domain that sync to an Azure Active Directory (Azure AD) tenant. The tenant contains the shown in the following table.

All the users work remotely.
Azure AD Connect is configured in Azure as shown in the following exhibit.

Connectivity from the on-premises domain to the internet is lost.
Which user can sign in to Azure AD?

User1 only

User1 and User 3 only

User1, and User2 only

User1, User2, and User3

QUESTION 88
You have a Microsoft 365 tenant that has 5,000 users. One hundred of the users are executives. The executives have a dedicated support team.
You need to ensure that the support team can reset passwords and manage multi-factor authentication (MFA) settings for only the executives. The solution must use the principle of least privilege.
Which object type and Azure Active Directory (Azure AD) role should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

QUESTION 89
SIMULATION
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Microsoft 365 Username:[email protected]
Microsoft 365 Password: =1122334455667788
If the Microsoft 365 portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 99999999
You need to configure the Group Administrator role to meet the following requirements:

Ensure that Allan Deyoung can approve and reject requests to activate the role.

Ensure that Christie Cline can request activation of the role.

Use the principle of least privilege.

To complete this task, sign in to the appropriate admin center.

QUESTION 90
You have an Azure Active Directory (Azure Azure) tenant that contains the objects shown in the following table.
* A device named Device1
* Users named User1, User2, User3, User4, and User5
* Five groups named Group1, Group2, Group3, Ciroup4, and Group5
The groups are configured as shown in the following table.

How many licenses are used if you assign the Microsoft Office 365 Enterprise E5 license to Group1?

SC-300’s module on Group-based licensing states two key rules: (1) licenses apply only to users (not devices) and (2) nested groups are not supported-only direct user members of the licensed group receive licenses. In the scenario, Group1 is assigned the Office 365 E5 license and has direct members User1, User3 (Guest), Group2, and Group4. Because nested groups (Group2, Group4 # Group5 # User5) are not processed, User2 and User5 do not receive licenses via Group1. Device1 is irrelevant because devices cannot be licensed. The study content also notes that guest users can be assigned licenses and that doing so consumes a license from the tenant’s pool when assigned via group or individually. Therefore, the only license consumptions from Group1’s direct membership are User1 and User3 (Guest), totaling 2 licenses.
This directly reflects the SC-300 guidance: “Group-based licensing assigns licenses to direct user members only; nested groups are not supported. Guests can receive licenses and will consume them if assigned.”

QUESTION 91
You have a Microsoft 365 tenant.
You need to Identity users who have leaked credentials. The solution must meet the following requirements:
* Identity sign-ms by users who are suspected of having leaked credentials.
* Flag the sign-ins as a high-risk event.
* Immediately enforce a control to mitigate the risk, while still allowing the user to access applications.
What should you use? To answer, select the appropriate options m the answer area.

Explanation:

QUESTION 92
You have an Azure subscription that contains the following virtual machine Name: VM1 Azure region: East US System-assigned managed identity: Disabled You create the managed identities shown in the following table.

You perform the following actions:
* Assign Managed1 to VM1.
* Create a resource group named RG1 in the West US region.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:

QUESTION 93
You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.
A contractor uses the credentials of [email protected].
You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as [email protected].
What should you do?

Run the New-MgUser cmdlet.

Add a custom domain name to contoso.com.

Run the New-MgInvitation cmdlet.

Implement Microsoft Entra Connect sync.

Correct:
* Create a guest user account in contoso.com.
* Run the New-AzureADMSInvitation cmdlet. [For Microsoft Active Directory]
* Run the New-MgInvitation cmdlet. [For Microsoft Entra]
Incorrect:
* Add a custom domain name to contoso.com
* Add a WS-Fed identity provider.
* Configure the External collaboration settings.
* Implement Azure AD Connect.
* Implement Microsoft Entra Application Proxy.
* Implement Microsoft Entra Connect sync
* Run the New-AzADUser cmdlet.
* Run the New-MgUser cmdlet.
Note:
* New-AzureADMSInvitation
This cmdlet is used to invite a new external user to your directory.
* New-MgInvitation
Microsoft.Graph.Identity.SignIns
Use this API to create a new invitation or reset the redemption status for a guest user who already redeemed their invitation. Invitation adds an external user to the organization Reference:
https://docs.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal
https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation
https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation?view=azureadps-2.0

QUESTION 94
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
All users who run applications registered in Azure AD are subject to conditional access policies.
You need to prevent the users from using legacy authentication.
What should you include in the conditional access policies to filter out legacy authentication attempts?

a cloud apps or actions condition

a sign-in risk condition

a client apps condition

a user risk condition

QUESTION 95
You have a Microsoft Entra tenant that has a Microsoft Entra ID P1 license.
You need to review the Microsoft Entra ID sign-in logs to investigate sign-ins that occurred in the past.
For how long does Microsoft Entra ID store events in the sign-in logs?

14 days

30 days

90days

365 days

QUESTION 96
You have an Azure AD tenant named contoso.com that contains a group named All Company and has the following Identity Governance settings:
* Block external users from signing in to this directory: Yes
* Remove external user Yes
* Number of days before removing external user from this directory: 30
On March 1, 2022, you create an access package named Package1 that has the following settings:
* Resource roles
o Name: All Company
o Type: Group and Team
o Role: Member
* Lifecycle
o Access package assignment expire: On date
o Assignment expiration date: April 1, 2022
On March 1, 2022, you assign Package1 to the guest users shown in the following table.

On March 2, 2022, you assign the Reports reader role to Guest1.
On April 1(2022, you invite a guest user named Guest3 to contoso.com.
On April 4, 2022, you add Guest3 to the All Company group.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:

QUESTION 97
You have a Microsoft Entra tenant that contains the users shown in the following table.

You have an administrative unit named Au1.Group1, User2, and User3are members of Au1.
User5 is assigned the User Administrator role for Au1.
For which users can User5 reset passwords?

User1 and User2 only

User2 and User3 only

User3 and User4 only

User1, User2, and User3

QUESTION 98
You create a Log Analytics workspace.
You need to implement the technical requirements for auditing.
What should you configure in Azure AD?

Diagnostics settings

External Identities

App registrations

To meet auditing and monitoring requirements, Azure AD must send sign-in logs and audit logs to an external location such as a Log Analytics workspace, Azure Storage account, or Event Hub. This is configured using Diagnostics settings in Azure AD.
According to Microsoft documentation in “Monitor Azure Active Directory activity logs in Azure Monitor” and the SC-300 learning objective “Implement and monitor identity governance” , you must enable diagnostic settings to stream directory logs to a Log Analytics workspace.
The scenario specifies:
“You create a Log Analytics workspace. You need to implement the technical requirements for auditing.” By configuring Azure AD’s Diagnostics settings, you can:
* Send Sign-in logs, Audit logs, and Provisioning logs to Log Analytics.
* Correlate identity events with security insights in Azure Sentinel or Microsoft Defender for Cloud Apps.
Microsoft documentation confirms:
“To collect and analyze Azure AD sign-in and audit data, configure diagnostic settings to send logs to Log Analytics.” Other options do not meet the requirement:
* A. Company branding: Only affects login pages, not logging or auditing.
* C. External Identities: Controls guest access, not logging.
* D. App registrations: Used for app integration, not auditing.

QUESTION 99
You have a Microsoft 365 E5 subscription. You need to perform the following tasks:
* Identify the locations and IP addresses used by Azure AD users to sign in
* Review the Azure AD security settings and identify improvement recommendations.
* Identify changes to Azure AD users or service principle.
What should you use for each task? To answer, drag the appropriate resources to the correct requirements.
Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Explanation:

QUESTION 100
You have an Azure Active Directory (Azure AD) tenant that has the default App registrations settings. The tenant contains the users shown in the following table.

You purchase two cloud apps named App1 and App2. The global administrator registers App1 in Azure AD.
You need to identify who can assign users to App1, and who can register App2 in Azure AD.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal-assign-users
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added

QUESTION 101
You have a Microsoft Entra tenant that contains a group named Group1 and two users named User1 and User2. User1 is a member of Group1.
You register an enterprise application named App1.
You enable self-service application access for App1 and configure the following settings:
Allow users to request access to this application: Yes
To which group should assigned users be added: Group1
Require approval before granting access to this application: Yes
Who is allowed to approve access to this application: User2
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Explanation:
User1 must request access to App1 before they can use the app: No
If User2 requests access to App1, they will be added to Group1 automatically: Yes User2 can approve App1 requests by using the Microsoft Entra admin center: Yes Let’s break this down step by step based on Microsoft Entra ID self-service application access and the configured settings, as outlined in Microsoft Identity and Access Administrator documentation.
Understanding Self-Service Application Access in Microsoft Entra ID:
Self-service application access in Microsoft Entra ID allows users to request access to applications without needing an administrator to manually assign them. This is configured on a per-application basis.
The settings for App1 are:
Allow users to request access to this application: Yes- Users can request access to App1.
To which group should assigned users be added: Group1- Users who are granted access will be added to Group1, which provides the necessary permissions to use App1.
Require approval before granting access to this application: Yes- Access requests must be approved before the user is added to Group1.
Who is allowed to approve access to this application: User2- User2 is the designated approver for access requests to App1.
Statement 1: User1 must request access to App1 before they can use the app.
Analysis:
User1 is already a member of Group1, as stated in the question.
The self-service settings specify that users who are granted access to App1 will be added to Group1. This implies that membership in Group1 is what grants access to App1.
Since User1 is already a member of Group1, they already have access to App1. In Microsoft Entra ID, if a user is already assigned to an application (either directly or via group membership), they do not need to request access through the self-service process-they can simply use the app.
The self-service access request process is for users who are not yet assigned to the app (i.e., not in Group1).
Since User1 is already in Group1, they do not need to request access.
Conclusion:This statement isNo. User1 does not need to request access because they are already a member of Group1 and can use App1 immediately.
Statement 2: If User2 requests access to App1, they will be added to Group1 automatically.
Analysis:
User2 is not a member of Group1 (the question does not state that User2 is in Group1).
The self-service settings allow users to request access to App1, and the setting “To which group should assigned users be added: Group1” means that users who are granted access will be added to Group1.
However, the setting “Require approval before granting access to this application: Yes” means that User2’s request must be approved before they are added to Group1. The approver for App1 requests is User2 themselves, which introduces a potential conflict.
In Microsoft Entra ID, if a user is both the requester and the approver, the system typically allows them to approve their own request (unless additional policies prevent this, which is not specified in the question).
Therefore, User2 can request access and approve their own request.
Once the request is approved, User2 will be added to Group1 automatically as per the self-service settings.
The term “automatically” in the statement refers to the process after approval-once approved, the addition to Group1 happens without further manual intervention.
Conclusion:This statement isYes. If User2 requests access to App1 and approves their own request, they will be added to Group1 automatically.
Statement 3: User2 can approve App1 requests by using the Microsoft Entra admin center.
Analysis:
The self-service settings specify that User2 is the designated approver for access requests to App1.
In Microsoft Entra ID, approvers can manage access requests through the Microsoft Entra admin center (via the “My Access” portal or the “Access Requests” section, depending on their role and permissions).
User2, as the designated approver, will receive a notification (via email or the My Access portal) when a request is made. They can then log into the Microsoft Entra admin center, navigate to the access requests section, and approve or deny the request.
Even though User2 is not explicitly an admin, the fact that they are designated as the approver for App1 requests grants them the ability to approve requests through the Microsoft Entra admin center.
Conclusion:This statement isYes. User2 can approve App1 requests using the Microsoft Entra admin center.
Additional Considerations:
If User2 were not allowed to approve their own request (e.g., due to a separation of duties policy), Statement
2 might be affected. However, Microsoft Entra ID does not enforce such a restriction by default, and the question does not specify any additional policies.
The Microsoft Entra admin center is the primary interface for managing access requests, but users can also approve requests via email links or the My Access portal. The statement specifically mentions the admin center, which is a valid method.
Conclusion:
Statement 1:No- User1 does not need to request access since they are already in Group1.
Statement 2:Yes- User2 will be added to Group1 automatically after their request is approved (by themselves).
Statement 3:Yes- User2 can approve requests using the Microsoft Entra admin center.
References:
Microsoft Entra ID documentation: “Configure self-service application access” (Microsoft Learn:https://learn.
microsoft.com/en-us/entra/identity/enterprise-apps/configure-self-service) Microsoft Entra ID documentation: “Manage access requests” (Microsoft Learn:https://learn.microsoft.com
/en-us/entra/identity/governance/access-reviews-overview)
Microsoft Identity and Access Administrator (SC-300) exam study guide, which covers self-service application access and approval workflows in Microsoft Entra ID.

QUESTION 102
You have an Azure AD tenant that uses Azure AD Identity Protection and contains the resources shown in the following table.

Azure Multi-Factor Authentication (MFA) is enabled for all users.
User1 triggers a medium severity alert that requires additional investigation.
You need to force User1 to reset his password the next time he signs in. the solution must minimize administrative effort.
What should you do?

Configure a sign-in risk policy.

Mark User1 as compromised.

Reconfigure the user risk policy to trigger on medium or low severity.

Reset the Azure MFA registration for User1.

QUESTION 103
You have a hybrid Microsoft 365 subscription that contains the users show in the following table.

You plan to deploy an on-premises app1. App1 will be registered in Azure AD and will use Azure AD Application Proxy.
You need to delegate the installation of the Application Proxy connector and ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege.
Which user should perform the installation, and which role should you assign to Users1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.