Skip to main content

SC-300: Microsoft Identity and Access Administrator — 30-Day Study Program

  • Target exam: SC-300 (skills measured as of 27 April 2026), leading to the Identity and Access Administrator Associate certification
  • Time budget: ~2 h/weekday, ~4 h/weekend day ≈ 75 h total
  • Assumed baseline: Strong PowerShell, working knowledge of AD DS, M365 admin, basic KQL

Every topic below links to the relevant Microsoft Learn documentation. Read the linked page, then do the lab — the links are the study material, not a bibliography.

Domain weightings (drive your effort allocation)​

DomainWeightDays allocated
1. Implement and manage user identities20–25%Days 1–7
2. Implement authentication and access management25–30%Days 8–15
3. Plan and implement workload identities20–25%Days 16–21
4. Plan and automate identity governance20–25%Days 22–27
Review, practice exams, remediation—Days 28–30

Domain 2 gets the most days — it carries the highest weight and Conditional Access is the most heavily scenario-tested area on this exam.

Day 0 (before you start): Lab environment​

You cannot pass SC-300 on reading alone. Build a lab:

  1. Tenant: Create a fresh Entra tenant via the Entra admin center, or use an existing dev/test tenant. The old free M365 Developer Program is restricted; if you have a Visual Studio Enterprise subscription you get a dev tenant through it. Otherwise a free Entra tenant + M365 Business Premium trial works. (What is Microsoft Entra?)
  2. Licensing: Activate the Microsoft Entra ID P2 trial (or Entra Suite trial if available) — mandatory for PIM, ID Protection, access reviews, entitlement management. (Licensing fundamentals)
  3. Azure subscription: Free trial or PAYG with spending cap — needed for managed identities, PIM for Azure resources, Log Analytics, diagnostic settings.
  4. Hybrid lab (optional but recommended): One Windows Server VM running AD DS + Entra Connect. Hyper-V locally or a small Azure VM (deallocate when not in use).
  5. Tooling: Install-Module Microsoft.Graph; install the Global Secure Access client on a test VM later in Week 2.
  6. Break-glass account: Create one on day 0, exclude it from every CA policy you build. This is both lab hygiene and an exam objective.

Daily structure (repeat every study day)​

  • Block A (60–90 min): MS Learn modules + docs for the day's topics
  • Block B (45–60 min): Hands-on lab in your tenant — do everything in the portal and in Graph PowerShell where applicable
  • Block C (15 min): 10–15 practice questions on today's topic; log wrong answers in an error journal (topic, why wrong, correct concept)

The error journal is your Day 28–30 remediation input. Don't skip it.

WEEK 1 — Domain 1: User identities (Days 1–7)​

Day 1 — Tenant, roles, administrative units​

Day 2 — Users, groups, custom security attributes​

Day 3 — Bulk operations, licensing, devices​

Day 4 — External identities (B2B)​

Day 5 — Cross-tenant sync, external IdPs​

Day 6 — Hybrid identity I​

Day 7 — Hybrid identity II + Week 1 review​

  • Migrate from AD FS: staged rollout, decommission path
  • Entra Connect Health: agents, alerts, sync insights
  • Review: 30–40 mixed Domain 1 questions; update error journal
  • Checkpoint: Can you explain PHS vs PTA vs federation trade-offs, AU vs custom role use cases, and cross-tenant access settings without notes? If not, re-do before Week 2.

WEEK 2 — Domain 2: Authentication and access management (Days 8–15)​

Day 8 — Authentication methods​

Day 9 — MFA, SSPR, WHfB, password protection​

Days 10–11 — Conditional Access (two full days — highest-yield topic)​

Day 12 — Entra ID Protection​

Day 13 — Global Secure Access​

Day 14 — Domain 2 consolidation lab​

Day 15 — Domain 2 review​

  • 40–50 mixed questions on auth + CA + ID Protection + GSA; error journal
  • Checkpoint: Given a scenario table (user, location, device, app), can you predict which CA policies apply and the resulting access decision? This is the core exam skill — the CA deployment planning guide is good revision.

WEEK 3 — Domain 3: Workload identities (Days 16–21)​

Day 16 — Identity types for workloads​

Day 17 — Enterprise applications​

Day 18 — Application Proxy + SaaS integration​

Day 19 — App registrations​

Day 20 — Defender for Cloud Apps​

Day 21 — Domain 3 review​

  • 40 questions; error journal
  • Checkpoint: Delegated vs application permissions, app object vs SP, MI selection matrix, App Proxy pre-auth modes — all explainable without notes.

WEEK 4 — Domain 4: Identity governance (Days 22–27)​

Day 22 — Entitlement management I​

Day 23 — Entitlement management II​

Day 24 — Access reviews​

Day 25 — PIM​

Day 26 — Monitoring, logs, KQL​

Day 27 — Domain 4 review​

  • 40 questions; error journal
  • Checkpoint: Entitlement management object model (catalog → package → policy), access review outcomes, PIM settings matrix, which log answers which question.

Days 28–30 — Full review and exam readiness​

Day 28 — Full practice exam #1​

Day 29 — Full practice exam #2 + gap remediation​

  • Second full-length attempt (MeasureUp official practice test is the highest-fidelity paid option)
  • Target: consistently ≥80% before sitting the real exam (pass mark is 700 scaled, roughly ~70%)
  • Re-lab anything you got wrong that has a hands-on component — muscle memory beats re-reading

Day 30 — Light review + logistics​

  • Skim error journal end-to-end; re-read the CA and PIM settings matrices
  • Review exam mechanics: ~40–60 questions, case studies, possible lab-style items; you get Microsoft Learn access during the exam — practice searching Learn quickly for exact settings names, don't plan to rely on it
  • Book/sit the exam. Online proctored or Pearson VUE centre (Albury–Wodonga: nearest centres may be Wagga/Melbourne — online proctoring is usually the practical option; check room requirements)

Resource stack (in priority order)​

  1. Microsoft Learn — SC-300 official learning paths (free, maps 1:1 to objectives; follow the course SC-300T00 outline)
  2. Your lab tenant — non-negotiable
  3. Microsoft Learn Practice Assessment (free, official)
  4. John Savill's SC-300 Study Cram (YouTube) — watch at Week 4 start as consolidation, not as primary learning
  5. MeasureUp SC-300 — optional paid practice exam
  6. Microsoft Graph PowerShell docs — do every lab task twice: portal, then PowerShell

Exam-technique notes​

  • Scenario questions usually hinge on least privilege and lowest licence that satisfies the requirement — when two answers both work, pick the cheaper/lesser-privileged one
  • "Minimize administrative effort" = the most managed/automated option (Cloud Sync over Connect where features allow, dynamic groups over assigned, group-based licensing, access packages over manual assignment)
  • Know licence gates: P1 (CA, group-based licensing basics), P2 (PIM, ID Protection, access reviews, entitlement management), Workload ID Premium (workload identity risk, CA for workload identities), Entra Suite (GSA Private/Internet Access + governance bundle)
  • Case studies: read the requirements first, then mine the environment description only for what each question needs