The SC-300 exam earns you the Microsoft Certified: Identity and Access Administrator Associate credential. It validates your ability to configure and manage Microsoft Entra ID, implement Conditional Access policies, operate hybrid identity solutions, and enforce identity governance. Updated April 27, 2026, the exam covers four domains with a passing score of 700 on a 1000-point scale.
What Is the SC-300 Certification?
The Microsoft Certified: Identity and Access Administrator Associate, earned by passing exam SC-300, validates your ability to design, implement, and operate identity and access management solutions using Microsoft Entra ID. Identity has replaced the network perimeter as the primary security boundary in modern cloud environments, and this certification proves you can manage that boundary at an enterprise level.
The credential targets IT professionals who configure and manage identities throughout their lifecycles — users, devices, Azure resources, and applications. You are expected to understand Zero Trust principles, implement hybrid identity solutions, enforce Conditional Access policies, and operate identity governance frameworks. According to Microsoft’s official certification page, the exam was last updated on April 27, 2026, so the content reflects current Entra ID capabilities including Global Secure Access and passkey authentication.
The role aligns with the security engineering career track at Microsoft. With an estimated salary floor of $115,000 in the United States and 56 active job postings requiring this credential as of mid-2026, SC-300 delivers tangible career value for anyone specializing in Azure identity management.
SC-300 Exam Details
Before committing study time, understand the exam logistics. The SC-300 exam is proctored through Pearson VUE and costs $165 USD, though pricing varies by region. You have 100 minutes to complete the assessment, which contains 40 to 60 questions in multiple formats: multiple-choice, multi-select, case studies, and complex scenario-based items with interactive elements.
A passing score of 700 on a 1000-point scale is required. Microsoft does not publish exact scoring methodology, but each domain carries a weighted percentage, and the exam adapts question difficulty within those domains. If you fail, you can retake after 24 hours for the first attempt; subsequent retakes require longer waiting periods per Microsoft’s retake policy.
The exam is available in English, German, Spanish, French, Italian, Japanese, Korean, Portuguese (Brazil), and both Simplified and Traditional Chinese. Remote online proctoring is available, so you can take the exam from home. The certification must be renewed annually through a free online assessment on Microsoft Learn — no exam fee required for renewal.
| Detail | Value |
|---|---|
| Exam Code | SC-300 |
| Cost | $165 USD (varies by region) |
| Duration | 100 minutes |
| Questions | 40–60 |
| Passing Score | 700/1000 |
| Renewal Period | 12 months (free online assessment) |
| Prerequisites | None formally; Azure and M365 experience recommended |
Exam Domains Breakdown
The SC-300 tests four domains of roughly equal weight. Understanding what each domain covers and its percentage range helps you allocate study time proportionally.
Implement and manage user identities (20–25%): This domain tests your ability to configure Microsoft Entra tenants, manage built-in and custom roles, work with administrative units, evaluate effective permissions, and manage domains for both Entra ID and Microsoft 365. You need to know how to create and manage users and groups, handle custom security attributes, automate bulk operations via PowerShell, manage device join and registration, assign licenses, and configure external collaboration settings including cross-tenant access and synchronization. Hybrid identity with Entra Connect Sync and Cloud Sync also falls here.
Implement authentication and access management (25–30%): This is the heaviest-weighted domain. Expect questions on authentication methods — certificate-based authentication, Temporary Access Pass, OAuth 2.0 tokens, Microsoft Authenticator, and passkeys (FIDO2). You must understand tenant-wide MFA settings, self-service password reset, Windows Hello for Business, session revocation, password protection, and Kerberos for hybrid identities. Conditional Access policies are a major component here: planning, implementing assignments and controls, testing, session management, device-enforced restrictions, continuous access evaluation, authentication context, and protected actions. Identity Protection with risk-based policies for users and sign-ins rounds out this domain.
Plan and implement workload identities (20–25%): This domain covers managed identities, service principals, and the application lifecycle in Entra ID. You need to select the right identity type for applications and Azure workloads, assign managed identities to resources, and use them to access other Azure services. Enterprise application settings, Application Proxy for on-premises apps, SaaS app integration, app roles, consent management, and application collections are all fair game. App registration with API permissions, authentication configuration, and monitoring through Defender for Cloud Apps — including cloud discovery, connected apps, application-enforced restrictions, and OAuth app policies — are heavily tested.
Plan and automate identity governance (20–25%): This domain focuses on Entitlement Management (access packages, catalogs, access requests, terms of use), access reviews, and Privileged Identity Management (PIM). You need to configure PIM for both Entra roles and Azure resource roles, manage the approval workflow, and analyze PIM audit logs. Break-glass accounts, monitoring with diagnostic settings, KQL queries in Log Analytics, workbooks, and Identity Secure Score are also tested in this domain.
What Changed in April 2026
Microsoft updated the SC-300 exam on April 27, 2026. The four domain names remain the same, but several objectives received meaningful updates according to the official study guide change log.
The most notable addition is explicit coverage of Global Secure Access within the authentication domain. This includes deploying Global Secure Access clients and managing both Private Access and Internet Access (including Internet Access for Microsoft 365). If you have not worked with Microsoft’s Global Secure Access — their SASE-style Zero Trust network access solution — you will need to lab it before exam day.
Passkey (FIDO2) authentication now appears alongside certificate-based authentication, Temporary Access Pass, and Microsoft Authenticator in the authentication methods objectives. The Defender for Cloud Apps section now explicitly references configuring cloud discovery results and connected apps. Monitoring objectives were expanded to include KQL queries in Log Analytics workspaces and Identity Secure Score.
Most of these changes reflect features that were already in production. If you have been working with Entra ID in 2025–2026, the updates codify what you may already be doing. If your preparation relies on older study materials, verify they cover these newer objectives.
8-Week SC-300 Study Plan
Most candidates need 40 to 60 hours of focused preparation. Here is a concrete 8-week plan that balances theory with hands-on practice.
Weeks 1–2: User Identities and Hybrid Identity. Work through Microsoft Learn’s identity management learning path. Configure a Microsoft 365 developer tenant. Create users, groups, and administrative units. Set up Entra Connect Sync with a test Active Directory instance. Practice bulk operations with PowerShell using the Microsoft.Graph PowerShell module. Configure external collaboration and B2B scenarios.
Weeks 3–4: Authentication and Conditional Access. This is the highest-weighted domain, so invest accordingly. Configure every authentication method: SMS, phone call, Microsoft Authenticator app, FIDO2 security keys, certificate-based authentication, and Temporary Access Pass. Build Conditional Access policies for each control type — block access, require MFA, require compliant device, require a named location. Test what happens when conditions conflict. Deploy Self-Service Password Reset and verify reporting. Configure Identity Protection and set up risk-based policies with different risk levels.
Weeks 5–6: Workload Identities and Applications. Create app registrations, configure API permissions, and assign managed identities to Azure VMs and Azure Functions. Integrate a SaaS application through the gallery. Configure Application Proxy for a simulated on-premises web app. Set up Defender for Cloud Apps and review cloud discovery results. Build consent frameworks and test application-enforced restrictions.
Weeks 7–8: Governance, PIM, and Review. Create access packages with Entitlement Management. Configure access reviews for groups and applications. Set up PIM for Entra admin roles and Azure resource roles. Create break-glass accounts and document the procedure. Build KQL queries in Log Analytics to monitor sign-in activity. Take two full-length practice assessments. Review weak areas from practice test results.
Hands-On Labs You Need
Reading about Entra ID configuration is not enough. The SC-300 tests practical competence. Set up a Microsoft 365 developer program tenant — it is free and gives you a sandbox with Entra ID P2 features active for 90 days. Extend it with an Azure free account.
These are the mandatory lab exercises, ranked by exam relevance:
- Conditional Access policy builder: Create at least 10 policies covering different scenarios — MFA for all users, MFA only for untrusted locations, block legacy authentication, require compliant device for Exchange Online, require managed device for SharePoint. Test each one with a user account and verify the behavior.
- Hybrid identity setup: Install Entra Connect on a test VM with Active Directory Domain Services. Sync users, configure password hash synchronization, and test pass-through authentication. Verify that cloud and on-premises users can sign in.
- Privileged Identity Management: Activate a Global Administrator role through PIM, complete an approval workflow, and review the audit log. Configure time-bound activation and require justification.
- Entitlement Management: Build an access package with a catalog, assign it to a connected organization, and submit an access request through the My Apps portal. Configure automatic access reviews.
- Log Analytics queries: Write KQL queries against the SigninLogs and AuditLogs tables. Create a workbook that visualizes failed sign-ins by location and filter by Conditional Access policy name.
- Global Secure Access: Deploy a Global Secure Access client and configure both Private Access and Internet Access profiles. This is the newest exam content and least likely to be covered by third-party materials.
Practice Tests That Actually Help
The official Microsoft practice assessment is the starting point. It is free and uses the same question format and difficulty level as the real exam. Take it once at the beginning of your study period to establish a baseline, and again two weeks before your exam date to measure progress.
When evaluating third-party practice tests, prioritize providers that update their question banks to reflect the April 2026 objectives. Outdated question banks will not cover Global Secure Access, passkeys, or the updated Defender for Cloud Apps objectives. Look for explanations that reference specific Entra ID portal navigation paths rather than generic identity concepts.
The most common question format on SC-300 is the scenario-based question: you are given a business requirement, a current configuration state, and four possible actions. These require understanding which Entra ID feature solves which problem, not just memorizing terminology. For example, knowing the difference between Conditional Access session controls, application-enforced restrictions in Defender for Cloud Apps, and authentication context is critical because all three can restrict app access, but each operates at a different layer.
Aim for 80% or higher on practice tests before scheduling the real exam. If you are scoring below 70%, revisit the domain-specific Microsoft Learn modules rather than grinding more questions.
Career Path and Salary Impact
The SC-300 is an Associate-level certification in Microsoft’s credential framework. It serves two strategic career purposes: as a standalone specialization in identity and access management, and as a stepping stone toward the Microsoft Certified: Cybersecurity Architect Expert, which requires passing both SC-300 and SC-100 (or its replacement).
For professionals coming from CompTIA Security+, the SC-300 provides Azure-specific depth that employers increasingly require. For those already holding Azure certifications like AZ-104 or AZ-305, the SC-300 adds the identity specialization that rounds out a cloud architect’s skill set.
Annual renewal is free through Microsoft Learn’s online assessment. This is a significant advantage over certifications like CISSP that require continuing education credits and renewal fees. The free renewal model also means the certification stays aligned with current technology — Microsoft updates the assessment to reflect platform changes, so your credential does not become stale. For a complete strategy on managing multiple annual renewals, see our certification renewal planning guide.