Microsoft - SC-300: Microsoft Identity and Access Administrator

Sample Questions

Explanation:

Microsoft Entra Internet Access and Microsoft Entra Private Access comprise Microsoft's Security Service Edge (SSE) solution. Global Secure Access is the unifying term used for both Microsoft Entra Internet Access and Microsoft Entra Private Access. Global Secure Access is the unified location in the Microsoft Entra admin center.

Microsoft Entra Internet Access's first Secure Web Gateway (SWG) features include web content filtering based on domain names. Microsoft integrates granular filtering policies with Microsoft Entra ID and Microsoft Entra Conditional Access, which results in filtering policies that are user-aware, context-aware, and easy to manage.

There are several steps to configuring web content filtering. Take note of where you need to configure a Conditional Access policy.

1. Enable internet traffic forwarding.
2. Create a web content filtering policy.
3. Create a security profile.
4. Link the security profile to a Conditional Access policy.
5. Assign users or groups to the traffic forwarding profile.

References:

What is Global Secure Access?

How to configure Global Secure Access web content filtering

Explanation:

Microsoft Entra ID allows you to grant users just-in-time membership and ownership of groups through Privileged Identity Management (PIM) for Groups. Groups can be used to control access to a variety of scenarios, including Microsoft Entra roles, Azure roles, Azure SQL, Azure Key Vault, Intune, other application roles, and third-party applications.

PIM for Groups is part of Microsoft Entra Privileged Identity Management – alongside with PIM for Microsoft Entra roles and PIM for Azure Resources, PIM for Groups enables users to activate the ownership or membership of a Microsoft Entra security group or Microsoft 365 group. Non-security enabled groups can't be enabled for role assignments and can't be managed by PIM for Groups. Groups can be used to govern access to various scenarios that include Microsoft Entra roles, Azure roles, Azure SQL, Azure Key Vault, Intune, other application roles, and third party applications.

With PIM for Groups you can use policies similar to ones you use in PIM for Microsoft Entra roles and PIM for Azure Resources: you can require approval for membership or ownership activation, enforce multifactor authentication (MFA), require justification, limit maximum activation time, and more. Each group in PIM for Groups has two policies: one for activation of membership and another for activation of ownership in the group.

References:

What is Microsoft Entra Privileged Identity Management?

Privileged Identity Management (PIM) for Groups

Explanation:

We should create a guest account for the contractor. With a Microsoft Entra B2B guest account, you can invite anyone to collaborate with your organization using their own work, school, or social account.

B2B collaboration is a capability of Microsoft Entra External ID that lets you collaborate with users and partners outside of your organization. With B2B collaboration, an external user is invited to sign in to your Microsoft Entra workforce tenant using their own credentials. This B2B collaboration user can then access the apps and resources you want to share with them. A user object is created for the B2B collaboration user in the same directory as your employees. B2B collaboration user objects have limited privileges in your directory by default, and they can be managed like employees, added to groups, and so on.

References:

Understand and manage the properties of B2B guest users

Quickstart: Add a guest user and send an invitation

Explanation:

Private Access provides two ways to configure the private resources that you want to tunnel through the service. You can configure Quick Access, which is the primary group of FQDNs and IP addresses that you want to secure. You can also configure a Global Secure Access app for per-app access, which allows you to specify a subset of private resources that you want to secure. The Global Secure Access app provides a granular approach to securing your private resources.

When you configure the Quick Access and Global Secure Access apps, you create a new enterprise application. The app serves as a container for the private resources that you want to secure. The application has its own Microsoft Entra private network connector to broker the connection between the service and the internal resource. You can assign users and groups to the app, and then use Conditional Access policies to control access to the app.

Microsoft Entra private network connector does require outbound connectivity on port 80 and port 443, but does not require inbound connectivity.

References:

Learn about Microsoft Entra Private Access

How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy

Microsoft Entra Private Access for on-prem users

Explanation:

Azure RBAC allows users to manage keys, secrets, and certificates permissions, and provides one place to manage all permissions across all key vaults.

The Azure RBAC model allows users to set permissions on different scope levels: management group, subscription, resource group, or individual resources. Azure RBAC for key vault also allows users to have separate permissions on individual keys, secrets, and certificates.

User1 is a Key Vault Administrator scoped to Sub1. User1 can perform all data plane operations on KV1 and KV2 and all objects in them, including certificates, keys, and secrets.

User2 is a Key Vault Reader scoped to RG1. User2 can read metadata of KV1 and KV2 and its certificates, keys, and secrets. User2 cannot read any sensitive values such as secret contents or key material.

User3 is a Key Vault Secrets User scoped to KV1. User2 can read secret contents including secret portion of a certificate with private key only from KV1.

Reference: Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control