SC-300 · Domain 1: Implement and manage user identities · 24% of the exam
Task 1.2: Create, configure, and manage Microsoft Entra identities
Users and groups, dynamic membership, custom security attributes, bulk operations in the admin center and PowerShell, device join and registration, and group-based licensing.
Study it
Users, groups, dynamic membership and custom security attributes
Lesson coming
Bulk operations, device join and registration, and group-based licensing
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Security wants to label 30 enterprise applications with a Sensitivity value so that a Conditional Access policy can target every app labeled High. The value must not be readable by Global Administrators or other administrators by default, and only two security staff may set it. What should you use?
AA custom security attribute, with Attribute Assignment Administrator scoped to its attribute set
BA directory extension property registered on an app and set on each service principal
CAn administrative unit that holds the 30 enterprise applications, selected as the target of the Conditional Access policy
DA value in each enterprise application's Notes property, matched by a filter for applications in the policy
Show the answer and why
AA custom security attribute, with Attribute Assignment Administrator scoped to its attribute set
Correct
Administrators can't read custom security attributes by default, and filter for applications in Conditional Access matches on them.
BA directory extension property registered on an app and set on each service principal
Incorrect
Anyone who can read the object can read extension data, so administrators would see the value.
CAn administrative unit that holds the 30 enterprise applications, selected as the target of the Conditional Access policy
Incorrect
Administrative units contain only users, groups and devices, and Conditional Access doesn't target them.
DA value in each enterprise application's Notes property, matched by a filter for applications in the policy
Incorrect
Filter for applications matches custom security attributes, not the Notes property, which admins can read.
Custom security attributes are readable and assignable only by people holding the attribute roles; Global Administrators get no access to them by default. Attribute Assignment Administrator can be scoped to one attribute set, and Conditional Access filter for applications targets apps by their attribute values.
An Azure Automation runbook updated the department of about 8,000 cloud-only users every night with Set-MsolUser, and it has stopped working. The job must keep running unattended on its schedule. What should the runbook use now?
AUpdate-MgUser from Microsoft Graph PowerShell, signed in with a managed identity
BSet-AzureADUser from the AzureAD PowerShell module
CA bulk operation in the Microsoft Entra admin center that uploads the changes as a CSV file
DA Microsoft Entra Connect Sync rule that sets the department attribute
Show the answer and why
AUpdate-MgUser from Microsoft Graph PowerShell, signed in with a managed identity
Correct
Microsoft Graph PowerShell replaces the retired modules and runs unattended with an app-only identity.
BSet-AzureADUser from the AzureAD PowerShell module
Incorrect
The AzureAD module is deprecated along with MSOnline and only ran through March 30, 2025.
CA bulk operation in the Microsoft Entra admin center that uploads the changes as a CSV file
Incorrect
A bulk operation is a manual upload by a signed-in admin, so it can't run on the runbook's schedule.
DA Microsoft Entra Connect Sync rule that sets the department attribute
Incorrect
Connect Sync flows attributes from Active Directory; these users are cloud-only.
The AzureAD and MSOnline PowerShell modules were deprecated on March 30, 2024 and kept working only through March 30, 2025; Microsoft directs scripts to the Microsoft Graph PowerShell SDK. In Azure Automation, Connect-MgGraph with the account's managed identity lets Update-MgUser run without a signed-in user.
Contoso's 3,000 Windows 11 desktops are joined to on-premises Active Directory and configured with Group Policy, which must stay. Conditional Access must be able to recognize these desktops as corporate devices registered in Microsoft Entra ID. Which device identity should they get?
AMicrosoft Entra registered
BMicrosoft Entra joined
CMicrosoft Entra hybrid joined
DMicrosoft Entra joined through Windows Autopilot self-deploying mode
Show the answer and why
AMicrosoft Entra registered
Incorrect
Registration is meant for personal (BYOD) and mobile devices, not corporate domain-joined desktops.
BMicrosoft Entra joined
Incorrect
Microsoft Entra join replaces the Active Directory domain join, so the desktops would leave Group Policy behind.
CMicrosoft Entra hybrid joined
Correct
Hybrid joined devices stay joined to Active Directory and are registered with Microsoft Entra ID.
DMicrosoft Entra joined through Windows Autopilot self-deploying mode
Incorrect
Autopilot can deploy Microsoft Entra joined devices, which still leaves the on-premises domain.
Microsoft Entra hybrid joined devices are joined to on-premises Active Directory and registered with Microsoft Entra ID, so Group Policy keeps applying while Conditional Access can require a hybrid joined device. Microsoft Entra registered fits personal devices, and Microsoft Entra join fits cloud-managed devices without a domain join.
Contoso plans dynamic membership groups that will contain 1,200 unique users in total. What licensing do these groups need?
ANo license, since dynamic membership groups come with Microsoft Entra ID Free
BAt least 1,200 Microsoft Entra ID P1 licenses, one for each unique member
COne Microsoft Entra ID P1 license for each dynamic group
DMicrosoft Entra ID P2 for every member
Show the answer and why
ANo license, since dynamic membership groups come with Microsoft Entra ID Free
Incorrect
Dynamic membership needs a P1 license per unique member.
BAt least 1,200 Microsoft Entra ID P1 licenses, one for each unique member
Correct
Each unique user in one or more dynamic groups needs P1, though licenses don't have to be assigned to them.
COne Microsoft Entra ID P1 license for each dynamic group
Incorrect
Licensing is counted per unique member, not per group.
DMicrosoft Entra ID P2 for every member
Incorrect
P1 is enough for dynamic membership groups.
Dynamic membership groups require a Microsoft Entra ID P1 license (or Intune for Education) for each unique user who's a member of one or more dynamic groups. The licenses don't have to be assigned to those users, but the tenant must own enough of them.
A cloud-only user account was deleted by mistake 10 days ago. What can you do?
ANothing: deleted users can't be recovered
BRestore it from Deleted users, which keeps its properties
COpen a support case so that Microsoft restores it from backup
DRe-create the account with the same name, which links it to the old object
Show the answer and why
ANothing: deleted users can't be recovered
Incorrect
Deleted users stay restorable for 30 days.
BRestore it from Deleted users, which keeps its properties
Correct
Deleted accounts stay in a suspended state for 30 days and can be restored with all their properties.
COpen a support case so that Microsoft restores it from backup
Incorrect
Admins restore it themselves; after permanent deletion even Support can't.
DRe-create the account with the same name, which links it to the old object
Incorrect
A new account is a new object, not the deleted one.
After a user is deleted, the account remains suspended for 30 days and can be restored, along with its properties, from the deleted users list. After permanent deletion, neither you nor Microsoft Support can restore it.
An admin must create attribute sets and define new custom security attributes, but won't assign values to users or apps. Which role is the least privileged for that?
AAttribute Assignment Administrator
BGlobal Administrator
CAttribute Assignment Reader
DAttribute Definition Administrator
Show the answer and why
AAttribute Assignment Administrator
Incorrect
This role assigns attribute values; it doesn't define attributes.
BGlobal Administrator
Incorrect
Global Administrators have no custom security attribute permissions by default.
CAttribute Assignment Reader
Incorrect
Readers can only read assigned values.
DAttribute Definition Administrator
Correct
It's the minimum role to define and manage custom security attributes.
Microsoft Entra ID has dedicated roles for custom security attributes: Attribute Definition Administrator to define them, Attribute Assignment Administrator to assign values, and reader roles for each. Global Administrators have none of these permissions by default.
You must delete 300 departed users' cloud-only accounts in the Microsoft Entra admin center without scripting. What do you use?
ADownload users in Bulk operations, then upload the edited file
BBulk create in Bulk operations, with the 300 users' rows marked as deleted
CBulk restore in Deleted users, with a CSV of the 300 users
DBulk delete in Bulk operations, with the user principal names in its CSV template
Show the answer and why
ADownload users in Bulk operations, then upload the edited file
Incorrect
A download exports a list of users; uploading it again doesn't delete them.
BBulk create in Bulk operations, with the 300 users' rows marked as deleted
Incorrect
Bulk create only adds users; deleting them has its own template.
CBulk restore in Deleted users, with a CSV of the 300 users
Incorrect
Bulk restore brings deleted users back; it doesn't delete anyone.
DBulk delete in Bulk operations, with the user principal names in its CSV template
Correct
The bulk delete template takes a user principal name or object ID for each user to delete.
The Microsoft Entra admin center offers bulk operations for users, each with its own CSV template: bulk create, bulk delete, bulk restore and download. For bulk delete, you download the template, add a user principal name or object ID per user without changing the headers, and upload it.