Microsoft - SC-300: Microsoft Identity and Access Administrator

Sample Questions

Explanation:

Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure roles to require approval for activation, and choose one or multiple users or groups as delegated approvers. Delegated approvers have 24 hours to approve requests. If a request isn't approved within 24 hours, then the eligible user must re-submit a new request. The 24-hour approval time window isn't configurable.

Reference: Approve or deny requests for Microsoft Entra roles in Privileged Identity Management

Explanation:

The query uses the SignInLogs table, which is available in Azure Monitor Log Analytics. To run KQL queries such as Query1 against Microsoft Entra sign-in activity logs, you must first configure Microsoft Entra diagnostic settings to send SigninLogs to a Log Analytics workspace.

Reference: Tutorial: Create a Log Analytics workspace to analyze sign-in logs

Explanation:

User2 is a Helpdesk Administrator scoped to AU1. User2 can reset the password for Helpdesk Admins (User4) and Users without admin role (User5) but not for Privileged Authentication Admins (User3).

User3 is a Privileged Authentication Admin scoped to AU2. User3 can reset the passwords for all users in AU2.

In the following table, the columns list the roles that can reset passwords and invalidate refresh tokens. The rows list the roles for which their password can be reset. For example, a Password Administrator can reset the password for Directory Readers, Guest Inviter, Password Administrator, and users with no administrator role. If a user is assigned any other role, the Password Administrator cannot reset their password.

References:

Who can reset passwords

Assign roles with administrative unit scope

• Create a Microsoft 365 group named Group1 that has dynamic user membership.
• Assign a Microsoft Entra Suite license to Group1.

Explanation:

To create a Microsoft 365 group with dynamic user membership, you must configure a dynamic membership rule. Dynamic User membership groups are created and managed in the Microsoft Entra admin center under Groups > New Group > Membership type = Dynamic User. The Microsoft 365 admin center and Intune admin center do not provide the interface for creating a Microsoft 365 group with dynamic membership rules.

Microsoft has moved license assignment management to the Microsoft 365 admin center. If you have security groups, mail enabled groups, or Microsoft 365 groups, you can assign or unassign licenses for those groups on the Licenses page in the Microsoft 365 admin center.

References:

Create or update a dynamic membership group in Microsoft Entra ID

Assign or unassign licenses to a group in the Microsoft 365 admin center

Explanation:

In Microsoft Entra ID, for more granular administrative control, you can assign a Microsoft Entra role with a scope that's limited to one or more administrative units. When a Microsoft Entra role is assigned at the scope of an administrative unit, role permissions apply only when managing members of the administrative unit itself, and don't apply to tenant-wide settings or configurations.

Admin1 is a Password Administrator scoped to AU1. User1 is a member of AU1. Admin1 can reset the password of User1.

Admin2 is a Password Administrator scoped to AU2. User2 is a member of AU1. Admin2 cannot reset the password of User2.

Admin3 is a tenant-wide Password Administrator. Admin3 can reset the passwords of User1, User2, and User3.

Reference: Assign roles with administrative unit scope