Free SC-300 practice test

In a restricted management administrative unit, only administrators assigned at that unit's scope can modify the objects inside; tenant-scoped roles, including Global Administrator and Privileged Role Administrator, are blocked (those two can manage the unit and assign themselves to it, which is audited). A role-assignable group protects the group itself, not the members' user objects from tenant-level User Administrators. Custom security attributes are metadata, and Microsoft Entra has no deny assignments. Protected actions add an authentication requirement to specific permissions; they do not change who holds the permission.

Custom security attributes are permissioned separately: Attribute Definition and Attribute Assignment Administrator (and reader) roles control them, and Global Administrators do not get read or assign access by default. Directory extensions and the on-premises extension attributes are readable by anyone who can read the user object. Managed identities are workload identities and have nothing to do with user metadata.

Group-based licensing on a dynamic membership group (rule such as user.department -eq "Sales") adds and removes licenses automatically as the attribute changes. An assigned group needs manual membership changes, and a script adds maintenance and lag. Licenses cannot be assigned to administrative units; they scope administration, not licensing.

Staged rollout lets selected groups use PHS or PTA (and seamless SSO) while the domain stays federated, so you can test before cutover. Converting the domain affects all users at once. Moving users to a new domain changes UPNs needlessly. Conditional Access can't choose the authentication provider.

Password hash synchronisation runs every 2 minutes, independent of the standard directory sync cycle, and Microsoft documents that the frequency can't be modified. The 30-minute default applies to the regular object/attribute sync scheduler, which is what Set-ADSyncScheduler adjusts.

CAE critical events are: account deleted or disabled, password changed or reset, MFA enabled for the user, an administrator revokes all refresh tokens, and high user risk detected by ID Protection. Creating report-only policies and changing licences are not critical events.

CAE evaluates only IP-range named locations; with country/region locations or MFA trusted IPs, Microsoft Entra issues a one-hour token without instant IP enforcement. Microsoft says to configure all egress IPs (IPv4 and IPv6) as an IP-based location. CAE doesn't support guest accounts, and the MFA trusted IPs feature should not be used for this.

Revoking sign-in sessions invalidates refresh tokens. For CAE-capable clients and services (Exchange, SharePoint, Teams), account disablement and token revocation are critical events enforced in near real time. Removing licenses or resetting MFA doesn't invalidate issued tokens, and deleting devices alone leaves user tokens valid.

Authentication strengths are a Conditional Access grant control; the built-in Phishing-resistant MFA strength allows only methods such as passkeys (FIDO2), Windows Hello for Business and certificate-based authentication. Targeting directory roles applies it only to admins. Per-user MFA can't specify which methods; disabling push affects everyone; a registration campaign encourages registration but enforces nothing.

The TAP policy defaults are: default lifetime 1 hour, minimum 1 hour, maximum 8 hours, one-time use False, length 8. With one-time use False, a pass can be used once or several times within its validity. Allowed values range from 10 minutes to 30 days (43,200 minutes).

Cloud Discovery can use Defender for Endpoint telemetry from onboarded devices instead of uploading firewall or proxy logs through a log collector. App connectors use an app's API for sanctioned apps you already know, session policies need traffic routed through the proxy, and OAuth policies govern consented apps.

User consent settings can limit consent to verified publishers and permissions classified as low impact. The admin consent workflow lets users request approval for apps they can't consent to, routed to reviewers. Assigning admin roles broadly defeats the purpose, and Conditional Access doesn't control consent.

With Assignment required set to Yes, only assigned users and groups can obtain tokens for the app, and My Apps shows the app only to assigned users. Hiding the app doesn't stop sign-in. A Conditional Access block works but is heavier and doesn't control visibility. Owners manage the app configuration.

Application proxy connectors make outbound connections only, so no inbound ports are needed; pre-authentication happens in Microsoft Entra ID, and KCD lets the connector obtain Kerberos tickets for IWA apps. A VPN or public IP exposes the network. App control proxies sessions to apps already reachable, and a SAML app needs a reachable endpoint and SAML support.

Conditional Access can target single-tenant service principals with location or service principal risk conditions; this requires Microsoft Entra Workload ID Premium. ID Protection also lists risky workload identities for investigation. User risk policies don't cover service principals, and registration campaigns are for user authentication methods.

Access packages bundle groups, sites and app roles; their policies define who can request, the approval chain and the expiration. A dynamic group has no request or approval flow and no expiry, an access review only re-certifies existing access, and PIM for Groups is for just-in-time privileged membership.

PIM for Groups lets users hold eligible membership or ownership of a group and activate it for a limited time, with the same settings as role activation. Dynamic rules don't expire, and access reviews are periodic certifications.

Connected organizations represent partner tenants or domains in entitlement management; a policy scoped to them lets their users request access, creating B2B guests on approval. Cross-tenant sync is for tenants in your own organisation, direct connect covers Teams shared channels, and Microsoft Entra tenants don't need SAML federation.

Entitlement management settings include the external user lifecycle: block external users from signing in when they lose their last assignment, and remove them after a set number of days. External collaboration settings govern invitations, and lifecycle workflows target employee joiner/mover/leaver scenarios.

The If reviewers don't respond setting can be No change, Remove access, Approve access or Take recommendations; Remove access (with auto apply) removes unreviewed users. Justification and recommendations help reviewers but don't decide outcomes for non-responses.