
SC-300 recently had a minor update, just some reorganization and slight wording changes. If you have already passed other Microsoft exams where AAD is a large part of the score, such as MS-500, AZ-500, MS-100 and MS-101 you probably already know quite a few of the topics the exam covers, so it shouldn’t be too hard an exam to prepare for, but there are two main things to think about as you commence.
The first thing to watch out for when you are preparing for this exam include not accidentally going in without knowledge of changes that have occurred with Azure Active Directory features over time. Not just new features, but enhancements to what may have been included for a while now. Where this is most likely to happen is when you haven’t worked too closely with the technology, especially premium functionality has expanded dramatically.
The example that I always like to use is Access Reviews, which were originally focused on Privileged Identity Management for Azure AD roles, but have expanded across Azure roles, groups and applications, for example. It’s easy to miss this kind of change when you aren’t always being exposed to new functionality as it is being introduced.
The second thing to consider with your preparation is whether your AAD exposure is mostly from within Microsoft 365 workloads, or with Azure workloads. This is going to change what you need to focus on for the exam, examples include app registrations being something that Microsoft 365 focused exam takers should take a look at, and Microsoft 365 groups being something that Azure admins may not have much exposure to. There are more than these two things, just make sure you are targeting features that you haven’t been exposed to, or that you have very limited exposure to.
Implement an identity management solution (25-30%)
Implement initial configuration of Azure Active Directory
- configure and manage Azure AD directory roles
- configure and manage custom domains
- configure and manage device registration options
- configure delegation by using administrative units
- configure tenant-wide settings
Create, configure, and manage identities
- create, configure, and manage users
- create, configure, and manage groups
- manage licenses
Implement and manage external identities
- manage external collaboration settings in Azure Active Directory
- invite external users (individually or in bulk)
- manage external user accounts in Azure Active Directory
- configure identity providers (social and SAML/WS-fed)
Implement and manage hybrid identity
- implement and manage Azure Active Directory Connect (AADC)
- implement and manage Azure AD Connect cloud sync
- implement and manage Password Hash Synchronization (PHS)
- implement and manage Pass-Through Authentication (PTA)
- implement and manage seamless Single Sign-On (SSO)
- implement and manage Federation excluding manual ADFS deployments
- implement and manage Azure Active Directory Connect Health
- troubleshoot synchronization errors
Implement an authentication and access management solution (25-30%)
Plan and implement Azure Multifactor Authentication (MFA)
- plan Azure MFA deployment (excluding MFA Server)
- implement and manage Azure MFA settings
- manage MFA settings for users
Manage user authentication
- administer authentication methods (FIDO2 / Passwordless)
- implement an authentication solution based on Windows Hello for Business
- configure and deploy self-service password reset
- deploy and manage password protection
- implement and manage tenant restrictions
- configure smart lockout thresholds
Plan, implement, and administer conditional access
- plan and implement security defaults
- plan conditional access policies
- implement conditional access policy controls and assignments (targeting, applications, and conditions)
- testing and troubleshooting conditional access policies
- implement application controls
- implement session management
Manage Azure AD Identity Protection
- implement and manage a user risk policy
- implement and manage sign-in risk policy
- implement and manage MFA registration policy
- monitor, investigate and remediate elevated risky users
Implement Access Management for Apps (10-15%)
Plan, implement, and monitor the integration of Enterprise Apps for Single Sign-On (SSO)
- implement and configure consent settings
- discover apps by using MCAS or ADFS app report
- design and implement access management for apps
- design and implement app management roles
- monitor and audit access / Sign-ins to Azure Active Directory integrated enterprise applications
- integrate on-premises apps by using Azure AD application proxy
- integrate custom SaaS apps for SSO
- configure pre-integrated (gallery) SaaS apps
- implement application user provisioning
Implement app registrations
- plan your line of business application registration strategy
- implement application registrations
- configure application permissions
- implement application authorization
- plan and configure multi-tier application permissions
Plan and implement an Identity Governance Strategy (25-30%)
Plan and implement entitlement management
- define catalogs
- define access packages
- plan, implement and manage entitlements
- implement and manage terms of use
- manage the lifecycle of external users in Azure AD Identity Governance settings
Plan, implement, and manage access reviews
- plan for access reviews
- create access reviews for groups and apps
- monitor access review findings
- manage licenses for access reviews
- automate access review management tasks
- configure recurring access reviews
Plan and implement privileged access
- define a privileged access strategy for administrative users (resources, roles, approvals, thresholds)
- configure Privileged Identity Management for Azure AD roles
- configure Privileged Identity Management for Azure resources
- assign roles
- manage PIM requests
- analyze PIM audit history and reports
- create and manage break-glass accounts
Monitor and maintain Azure Active Directory
- analyze and investigate sign-in logs to troubleshoot access issues
- review and monitor Azure AD audit logs
- enable and integrate Azure AD diagnostic logs with Log Analytics / Azure Sentinel
- export sign-in and audit logs to a third-party SIEM
- review Azure AD activity by using Log Analytics / Azure Sentinel, excluding KQL use
- analyze Azure Active Directory workbooks / reporting
- configure notifications