Microsoft Identity and Access Administrator Associate (SC-300) · 24% practice allocation

Microsoft SC-300: Implement and manage user identities Practice Questions

5 free sample questions from the Implement and manage user identities domain, with answers and explanations. The full SC-300 bank has 64 questions across 4 domains. Questions are scenario-based and written from the official Microsoft exam guide.

1.

You need alerts on Entra Connect sync errors and the health of your AD FS servers and domain controllers. What should you deploy?

  • A. Microsoft Defender for Identity sensors only
  • B. Azure Monitor agent on the Entra Connect server
  • C. Entra Connect staging mode server
  • D. Microsoft Entra Connect Health agents✓ Correct
Explanation

Microsoft Entra Connect Health provides monitoring and alerts for Entra Connect Sync, AD FS and AD DS through its agents (it requires Microsoft Entra ID P1). Defender for Identity detects attacks on AD rather than sync health. A staging server is for failover, not monitoring.

2.

You have three disconnected Active Directory forests from recent acquisitions and want a lightweight synchronisation option managed from the cloud, with high availability by installing more than one agent. What should you deploy?

  • A. Microsoft Entra Connect Sync in staging mode in each forest
  • B. Microsoft Identity Manager with a Graph connector
  • C. Microsoft Entra Cloud Sync with provisioning agents in each forest✓ Correct
  • D. A single Entra Connect Sync server per forest, each targeting the tenant
Explanation

Cloud Sync uses lightweight provisioning agents with configuration held in the cloud, supports disconnected forests, and you install multiple agents for high availability. Connect Sync supports only one active server per tenant (others in staging mode), so one active server per forest targeting the same tenant isn't supported. MIM is heavyweight and not the recommended approach.

3.

Corporate-owned Windows 11 laptops are cloud-managed with Intune and have no line-of-sight to on-premises domain controllers. Users should sign in to Windows with their Microsoft Entra work accounts. Which device identity should you use?

  • A. Microsoft Entra registered
  • B. Microsoft Entra hybrid joined
  • C. Microsoft Entra joined✓ Correct
  • D. Workplace join through AD FS device registration
Explanation

Microsoft Entra join is for organisation-owned devices whose primary identity is the cloud account, with no requirement for on-premises AD. Hybrid join needs the device to be joined to on-premises AD as well. Registration is for personal (BYOD) devices where users sign in with a personal account. AD FS workplace join is a legacy pattern.

4.

A partner organisation uses a non-Microsoft identity provider that supports SAML 2.0. Partner users should sign in to your apps with their own credentials. What should you configure?

  • A. SAML/WS-Fed identity provider federation for the partner domain✓ Correct
  • B. A Microsoft Entra Connect Sync connector to the partner's directory
  • C. Pass-through authentication agents pointed at the partner's identity provider
  • D. An enterprise application for the partner IdP with password-based SSO
Explanation

External Identities supports SAML/WS-Fed identity provider federation, so B2B guests from that domain authenticate at their own IdP. Entra Connect synchronises your own on-premises AD. Pass-through authentication validates against your own on-premises AD only. Password-based SSO stores credentials for an app; it does not federate guest authentication.

5.

You must create 600 new user accounts from an HR export and want a supported, scriptable approach that works with current tooling. What should you use?

  • A. New-MgUser from Microsoft Graph PowerShell, looping over the CSV✓ Correct
  • B. New-MsolUser from the MSOnline module, run from the Entra Connect server
  • C. The New-AzureADUser cmdlet from the AzureAD module
  • D. The Add-ADUser cmdlet run on the Entra Connect server
Explanation

Microsoft Graph PowerShell is the supported module for scripting Microsoft Entra operations; the MSOnline and AzureAD modules are retired. The admin center's Bulk create (CSV upload) is the no-code alternative. There is no Add-ADUser cmdlet, and creating on-premises AD users would only be right for synced identities, not for cloud-only accounts.

Test yourself across every SC-300 domain

The free SC-300 practice test mixes about 20 questions weighted like the exam. The full 64-question bank adds instant grading, flashcards and a timed mock exam.

Take the free SC-300 practice testPractice the full bank

Study this domain

Implement and manage user identities study guide (SC-300) →

Other SC-300 domains

← All Microsoft Identity and Access Administrator Associate study resources