Microsoft Identity and Access Administrator Associate (SC-300) · 24% practice allocation

Microsoft SC-300: Plan and automate identity governance Practice Questions

5 free sample questions from the Plan and automate identity governance domain, with answers and explanations. The full SC-300 bank has 64 questions across 4 domains. Questions are scenario-based and written from the official Microsoft exam guide.

1.

Every quarter, managers must confirm whether each guest in your Sales Microsoft 365 group still needs access. Denied guests should be removed automatically. What should you configure?

  • A. A quarterly access review of guests, reviewed by managers, with auto apply results✓ Correct
  • B. An entitlement management policy that sets a 90-day expiration directly on the group's members
  • C. A PIM for Groups setting requiring approval for membership
  • D. A scheduled PowerShell script that removes inactive guests
Explanation

Access reviews can target a group's guest members, recur quarterly, use managers as reviewers, and auto-apply denials to remove access. Expiration in entitlement management applies to access packages, not existing group members. PIM approval governs activation, not periodic certification.

2.

In PIM, every Global Administrator assignment is eligible, activation requires approval, and no approvers were configured. What risk does Microsoft call out, and how do you avoid it?

  • A. PIM silently disables approval; no action needed
  • B. Activations auto-approve after 24 hours; reduce the timeout
  • C. Approval falls back to each requester's manager, so you must set a manager for every admin
  • D. Tenant lockout: no active admin can approve; set approvers and keep break-glass accounts✓ Correct
Explanation

If no approvers are selected, active Privileged Role Administrators and Global Administrators are the default approvers. If every such assignment is eligible, no one can approve and the tenant is effectively locked. Microsoft's mitigation is to configure specific approvers and keep emergency access accounts with permanent active Global Administrator.

3.

An auditor asks who activated the Exchange Administrator role in the last month and why. Where is this recorded?

  • A. PIM audit history for Microsoft Entra roles✓ Correct
  • B. The Exchange admin center message trace for the admin's account
  • C. Identity Secure Score improvement actions
  • D. The SSPR usage report
Explanation

PIM keeps audit history of assignments and activations, including justification, ticket number and approver; the same events also appear in the Microsoft Entra audit log. Message trace covers mail flow, and Secure Score and SSPR reports don't track role activations.

4.

Your Azure subscription's Owner role should require approval and be activated just in time, like your directory roles. Where do you configure this?

  • A. PIM for Azure resources, on the subscription's Owner role settings✓ Correct
  • B. PIM for Microsoft Entra roles, on the Global Administrator role, which also covers Azure
  • C. Azure Policy with a deny effect on Owner assignments
  • D. Defender for Cloud regulatory compliance
Explanation

PIM for Azure resources manages eligible and active assignments and role settings for Azure RBAC roles at management group, subscription, resource group or resource scope. Microsoft Entra roles are separate. Azure Policy and Defender for Cloud don't provide just-in-time role activation.

5.

Administrators should not hold the User Administrator role permanently. They should request it when needed, for up to 4 hours, with MFA and a justification. What should you configure?

  • A. A Conditional Access policy with sign-in frequency 4 hours for the role
  • B. An access package containing the role with 4-hour expiration
  • C. PIM eligible assignments with 4-hour activation, MFA and justification✓ Correct
  • D. An administrative unit with time-bound membership
Explanation

PIM eligible assignments must be activated; the role's settings control activation maximum duration (1 to 24 hours), MFA or authentication context, justification, ticket information and approval. Sign-in frequency doesn't remove roles, and administrative units scope permissions rather than timing them.

Test yourself across every SC-300 domain

The free SC-300 practice test mixes about 20 questions weighted like the exam. The full 64-question bank adds instant grading, flashcards and a timed mock exam.

Take the free SC-300 practice testPractice the full bank

Study this domain

Plan and automate identity governance study guide (SC-300) →

Other SC-300 domains

← All Microsoft Identity and Access Administrator Associate study resources