Microsoft - SC-300: Microsoft Identity and Access Administrator

Sample Questions

Explanation:

It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.

Emergency access accounts are highly privileged, and they are not assigned to specific individuals. Emergency access accounts are limited to emergency or "break glass"' scenarios where normal administrative accounts can't be used. Microsoft recommends that you maintain a goal of restricting emergency account use to only the times when it is absolutely necessary.

Why use an emergency access account

An organization might need to use an emergency access account in the following situations:

• The user accounts are federated, and federation is currently unavailable because of a cell-network break or an identity-provider outage. For example, if the identity provider host in your environment has gone down, users might be unable to sign in when Azure AD redirects to their identity provider.
• The administrators are registered through Azure AD Multi-Factor Authentication, and all their individual devices are unavailable or the service is unavailable. Users might be unable to complete Multi-Factor Authentication to activate a role. For example, a cell network outage is preventing them from answering phone calls or receiving text messages, the only two authentication mechanisms that they registered for their device.
• The person with the most recent Global Administrator access has left the organization. Azure AD prevents the last Global Administrator account from being deleted, but it does not prevent the account from being deleted or disabled on-premises. Either situation might make the organization unable to recover the account.
• Unforeseen circumstances such as a natural disaster emergency, during which a mobile phone or other networks might be unavailable.

Create emergency access accounts

Create two or more emergency access accounts. These accounts should be cloud-only accounts that use the *.onmicrosoft.com domain and that are not federated or synchronized from an on-premises environment.

Reference: Manage emergency access accounts in Azure AD

Explanation:

The admin consent workflow gives admins a secure way to grant access to applications that require admin approval. When a user tries to access an application but is unable to provide consent, they can send a request for admin approval. The request is sent via email to admins who have been designated as reviewers. A reviewer takes action on the request, and the user is notified of the action.

To approve requests, a reviewer must have the permissions required to grant admin consent for the application requested. Simply designating them as a reviewer doesn't elevate their privileges.

To grant tenant-wide admin consent, you need:

• An Azure AD user account with one of the following roles:
  • Global Administrator or Privileged Role Administrator, for granting consent for apps requesting any permission, for any API.
  • Cloud Application Administrator or Application Administrator, for granting consent for apps requesting any permission for any API, except Azure AD Graph or Microsoft Graph app roles (application permissions).
  • A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application.

References:

Configure the admin consent workflow

Grant tenant-wide admin consent to an application

Explanation:

An access policy is the best possible answer option. Microsoft Defender for Cloud Apps access policies enable real-time monitoring and control over access to cloud apps based on user, location, device, and app.

Note: We don't neet to makes use Microsoft Defender for Cloud Apps to block access to cloud apps when a user is assessed as high risk. We could use an Identity Protection User-risk policy only or a Conditional Access policy only to achive the goal.

Reference: Access policies in Microsoft Defender for Cloud Apps

Explanation:

Keine der Azure RBAC-Rollen berechtigt für Schreibzugriffe auf die Kalender der Benutzer des Unternehmens.

Die delegierte Berechtigung Calendars.Read ermöglicht einer App, Kalenderdaten im Namen des angemeldeten Benutzers zu lesen.

Die Anwendungsberechtigung Calendars.ReadWrite ermöglicht einer App, Kalenderdaten in allen Kalendern ohne einen angemeldeten Benutzer zu erstellen, zu lesen, zu aktualisieren und zu löschen.

Der folgende Microsoft Learn-Artikel enthält weitere Informationen zum Thema:

Microsoft Graph-Berechtigungsreferenz

Explanation:

Managed identities can be added to any groups of type Security that are created in the cloud, are security-enabled, and have a membership type of Assigned. Microsoft 365 Groups cannot contain managed identities as members.

Manually adding cloud users directly to groups is only possible for groups that were created in the cloud and have the membership type "Assigned".