Microsoft - SC-300: Microsoft Identity and Access Administrator

Sample Questions

Explanation:

To ensure that if the group owners fail to review the membership of Review1, guest users are removed automatically, we need to configure the Upon completion settings as shown below.

Reference: Manage guest access with access reviews

• Allow users to request access to this application: Yes
• To which group should assigned users be added: Group1
• Require approval before granting access to this application: Yes
• Who is allowed to approve access to this application: User2

Explanation:

Self-service application access is a great way to allow users to self-discover applications, and optionally allow the business group to approve access to those applications.

If you set Allow users to request access to this application to Yes, all users will be allowed to view and request access to use the application when they click "Add App" in My Apps.

Once a user has requested access to the application and that request has been approved, they will be added to the group you select for the To which group should assigned users be added setting.

You can enable an email notifying approvers when a user requests access to an application that requires their approval. You can select up to ten individual business approvers. If you specify multiple approvers, any single approver can approve an access request in their My Apps portal. Groups aren't supported.

Reference: Enable self-service application assignment

Explanation:

Microsoft Entra organizations can use External ID cross-tenant access settings to manage collaboration with other Microsoft Entra organizations and Microsoft Azure clouds through B2B collaboration and B2B direct connect. The cross-tenant access settings provide granular control over inbound and outbound access, allowing you to trust multifactor authentication (MFA) and device claims from other organizations.

Default settings (B2B collaboration and B2B direct connect) apply to all external Microsoft Entra tenants not listed on the organizational settings tab. These default settings can be modified but not deleted. 

Here the default settings apply to the users in adatum.com while the fabrikam.com has their own organizational settings applied.

When using B2B Collaboration, you invite external users from another Microsoft Entra tenant. Those users become guest accounts (UserType = Guest) in your directory. They authenticate in their home tenant, but access resources in your tenant.

When using B2B Diret Connect, employees from another Entra tenant accessing your apps directly, without being added as guests.

By default, B2B collaboration with other Microsoft Entra organizations is enabled, and B2B direct connect is blocked. But the following comprehensive admin settings let you manage both of these features.

• Outbound access settings control whether your users can access resources in an external organization. You can apply these settings to everyone, or specify individual users, groups, and applications.

• Inbound access settings control whether users from external Microsoft Entra organizations can access resources in your organization. You can apply these settings to everyone, or specify individual users, groups, and applications.

• Trust settings (inbound) determine whether your Conditional Access policies trust the multifactor authentication (MFA), compliant device, and Microsoft Entra hybrid joined device claims from an external organization if their users already satisfied these requirements in their home tenants. For example, when you configure your trust settings to trust MFA, your MFA policies are still applied to external users, but users who already completed MFA in their home tenants don't have to complete MFA again in your tenant.

All outbound B2B collaboration settings for fabrikam.com are blocked. A user in contoso.com can't send a guest invitation to a user that has an email address of user1@fabrikam.com. Inbound B2B collaboration are allowed. This means, a user from fabrikam.com could invite a user from contoso.com as a guest user.

All outbound B2B collaboration settings for adatum.com are blocked. A user in contoso.com can't send a guest invitation to a user that has an email address of user1@adatum.com.

References:

Overview: Cross-tenant access with Microsoft Entra External ID

Manage cross-tenant access settings for B2B collaboration

Set up B2B direct connect with an external organization

Explanation:

The Key Vault Reader role is the minimum user role required to read the metadata of certificates, keys, and secrets stored in an Azure Key Vault. This role allows users to view the properties and attributes of these objects, but not to access their actual contents.

Azure built-in roles for Key Vault data plane operations

Reference: Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control

• App1 must be accessible only from the corporate network.
• The credentials for App1 must NOT be stored as plain text.
• Non-interactive scheduled tasks on Server1 must be able to authenticate to App1.

Explanation:

To restrict access to App1 to be accessible only from the corporate network, we should implement a Conditional Access policy, that has App1 defined as the Target resource and the corporate network as a Locations condition.

To enable non-interactive scheduled tasks on Server1 to authenticate to App1, we should use a certificate. A certificate meets the requirement that credentials for App1 must NOT be stored as plain text.

Windows Task Scheduler can run a script or executable that performs certificate-based authentication, as long as the script or app uses the certificate programmatically to get a token from Microsoft Entra ID. Windows Task Scheduler itself can't handle the certificate login.

Example:

$tenantId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$clientId = "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"
$certThumbprint = "ABC123DEF456..." # certificate thumbprint
$cert = Get-Item "Cert:\CurrentUser\My\$certThumbprint"
$token = Get-MsalToken -ClientId $clientId -TenantId $tenantId -ClientCertificate $cert -Scopes "https://graph.microsoft.com/.default"

Note: Managed identities in Azure can be used with Azure resources only. They can't be used by tasks or resources hosted on-premises.

References:

Use Get-MSALtoken to Connect to MS Graph

Connect to Microsoft Graph Using Get-MsalToken