Implement and manage user identities Study Guide — SC-300

Implement and Manage User Identities (20–25%)

This domain covers the tenant itself, the identities in it, the people you invite from outside, and the bridge to on-premises Active Directory. Microsoft weights it at 20–25% of SC-300. Most questions are scenarios: pick the scope, the sync tool or the sign-in method that meets a stated constraint at the lowest privilege or effort.

The examples follow one fictional company, Northwind, with offices in Paris and Sydney, an on-premises AD forest, and a partner called Fabrikam.

Roles and Administrative Units

Microsoft Entra roles grant permissions over directory objects. Every assignment has a scope: the whole tenant, an administrative unit (AU), or a single resource such as an app registration. Effective permissions are the role definition intersected with the scope.

• Built-in roles cover most needs: User Administrator, Helpdesk Administrator, Groups Administrator, Authentication Administrator, Privileged Role Administrator.
• Custom roles (P1) combine individual permissions, mainly for app registrations and enterprise apps.
• Administrative units limit an assignment to the users, groups and devices inside them. AU administrators need Microsoft Entra ID P1.
• Restricted management AUs go further: only administrators assigned at that AU's scope can change the objects inside. Tenant-scoped roles, including Global Administrator, are blocked. Global and Privileged Role Administrators can still manage the AU and assign themselves to it, which is audited. The setting is chosen at creation and can't be changed.

Example: Northwind's Paris helpdesk may reset passwords only for Paris staff, and nobody but the executive-support team may touch the CEO's account.

Helpdesk Administrator ──scope──▶ AU "Paris"        ✓ reset Paris users
Helpdesk Administrator ──scope──▶ AU "Paris"        ✗ reset Sydney users
Exec Support (User Admin) ─scope─▶ Restricted AU "Executives"  ✓ only they can edit the CEO
Global Administrator (tenant) ──────────────────────▶ ✗ blocked from editing the CEO

Takeaway: "Only for this subset" means an AU; "not even tenant admins" means a restricted management AU.

Tenant Settings, Domains and Branding

• Custom domains are verified with a TXT (or MX) record before users can take UPNs on them.
• Company branding customises the sign-in page (logo, background, text); it informs users but enforces nothing.
• Tenant properties, user, group and device settings control things such as whether users can register apps, create groups, or join devices, and the maximum devices per user.

Example: Northwind adds northwind.com, publishes the TXT record Microsoft shows, then verifies the domain and moves users' UPNs from northwind.onmicrosoft.com.

Takeaway: verification is DNS-based, and branding is cosmetic.

Users, Groups, Licences and Attributes

• Assigned groups have manually managed membership. Dynamic groups (P1) evaluate a rule such as user.department -eq "Sales".
• Group-based licensing assigns licences to a group so members get them automatically and lose them when they leave.
• Custom security attributes store sensitive metadata with separate permissions: Attribute Definition and Attribute Assignment Administrator (and reader) roles. Global Administrators have no access by default.
• Bulk operations: CSV upload in the admin center (bulk create, invite, delete), or Microsoft Graph PowerShell (New-MgUser, Update-MgUser). The MSOnline and AzureAD modules are retired.