SC-300 Implement and Manage User Identities — 10 Questions

Question 1

You are managing a Microsoft Entra ID tenant. You need to create a group that automatically includes all users from the Marketing department who are also located in the London office. If a user's department changes, they must be removed from the group automatically. Which group type and membership type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security group with Dynamic User membership. To automatically include users based on attributes (Department and Office), a Dynamic User membership is required. A Security group is the appropriate type for access control, whereas Microsoft 365 groups are primarily for collaboration. Dynamic User membership ensures that when a user's attributes change, they are automatically added or removed from the group based on the rule evaluation.

Answer

Security group with Assigned membership

Answer

Microsoft 365 group with Assigned membership

Answer

Microsoft 365 group with Dynamic Device membership

Question 2

A company plans to use Microsoft Entra B2B collaboration to work with several external partners. You need to configure the external collaboration settings to ensure that only users from the domain 'partner.com' can be invited. You also need to ensure that the external users cannot invite other guests. Which TWO settings should you configure?

Accepted Answer

Configure 'Collaboration restrictions' to 'Allow invitations only to the specified domains'. To prevent external users (guests) from inviting other guests, you must configure the 'Guest user access restrictions' setting in External collaboration settings to 'Guest users have limited access to features and objects in the directory' or specifically ensure the 'Guest invite settings' are configured to prevent guests from inviting others. Option D restricts internal users, which does not address the requirement regarding external users inviting others.

Answer

Set 'Guest user access' to 'Guest users have the same access as members'

Answer

Enable 'Self-service sign-up via user flows' for the tenant

Answer

Set 'Guest invite settings' to 'Only users assigned to specific admin roles can invite guest users'

Answer

Create a Cross-tenant access policy with 'Block all' for Inbound access

Question 3

Refer to the exhibit. You are using the Microsoft Graph API to create a new user account in Microsoft Entra ID. Based on the JSON payload provided, what will be the state of the user's password experience during their very first login attempt?

Accepted Answer

The user must change their password before they can access any resources. The passwordProfile object in the Microsoft Graph API contains the 'forceChangePasswordNextSignIn' property. When this is set to true in the JSON payload, the user is required to change their password upon their first successful authentication. The explanation should explicitly mention this property to justify why option B is correct.

Answer

The user will be prompted to set up Multi-Factor Authentication immediately

Answer

The user will be denied access because the password does not meet complexity requirements

Answer

The user will be logged in normally and can keep the temporary password indefinitely

Question 4

Your organization is implementing Self-Service Password Reset (SSPR). You want to ensure that users can only reset their passwords if they have registered at least two different authentication methods. Which configuration should you modify in the Microsoft Entra admin center to enforce this?

Accepted Answer

Number of methods required to reset in the SSPR properties. In the Microsoft Entra admin center, the setting is located under 'Password reset' > 'Authentication methods'. The specific setting is labeled 'Number of methods required to reset'. Option A is the correct functional setting, but the label provided in the option is slightly imprecise.

Answer

The 'Registration' tab in the Password Reset settings

Answer

The 'Combined security information registration' policy

Answer

Conditional Access policies for the 'My Profile' application

Question 5

Refer to the exhibit. An administrator creates a dynamic group rule for a management team. After 24 hours, several users with the job title 'Sales Manager' are not appearing in the group. What is the most likely cause for this behavior?

Accepted Answer

The Job Title attribute for those users is currently null or empty. The most likely cause is that the attribute value for the users does not match the rule criteria (e.g., a typo, extra spaces, or the attribute being null). Option C is the most plausible scenario for why specific users are excluded despite having the expected title. The explanation should explicitly state that dynamic group rules are case-insensitive, making A incorrect, and that there is no 1,000-member limit, making D incorrect.

Answer

The 'contains' operator is case-sensitive in dynamic group rules

Answer

The users have the 'accountEnabled' attribute set to false

Answer

Dynamic groups are limited to a maximum of 1,000 members

Question 6

You need to invite 50 external users from different organizations to a new project. You want to use the Microsoft Entra admin center to perform a bulk invite. Which TWO of the following are required to successfully complete this task?

Accepted Answer

A CSV file based on the 'Bulk invite users' template. To perform a bulk invite of external users in Microsoft Entra ID, you must download and use the specific CSV template ('Bulk invite users') and populate it with the user details. Furthermore, you need sufficient permissions; the account performing the bulk invite typically requires an administrative role such as User Administrator or Guest Inviter. (Note: Global Administrator also has this permission, though lesser privileged roles are recommended).

Answer

A JSON file containing the user display names and emails

Answer

An active subscription to Microsoft Entra ID P2

Answer

The 'Invite redirect URL' for each user in the upload file

Question 7

A user named Alex is a member of two groups: 'Group A' and 'Group B'. You assign a Microsoft 365 E5 license to 'Group A'. You then assign a Microsoft 365 E3 license to 'Group B'. Both groups have all license options enabled. What will be the resulting license state for Alex?

Accepted Answer

Alex will have both E5 and E3 licenses assigned. In Microsoft Entra ID, when a user is assigned multiple licenses via group-based licensing, the licenses are additive. However, if both licenses contain the same service plan (e.g., Exchange Online), the user does not consume two seats for that specific service; instead, the service plans are merged. The user will have both licenses assigned, and the resulting state is the union of all enabled service plans.

Answer

Alex will only have the E5 license as it is the higher SKU

Answer

The E3 license assignment will fail due to a license conflict

Answer

Alex will have the E5 license, and the E3 will be in a 'Suspended' state

Question 8

Your organization currently uses Microsoft Entra Connect to sync users from an on-premises Active Directory. You want to migrate to Microsoft Entra Cloud Sync for a specific subtree of users to simplify the infrastructure. Which of the following is a primary benefit of choosing Cloud Sync over Connect Sync?

Accepted Answer

Support for synchronizing from multiple disconnected on-premises AD forests. While Microsoft Entra Cloud Sync does support multiple disconnected AD forests, Microsoft Entra Connect (Sync) also supports multiple disconnected forests. A key primary benefit specifically highlighting Cloud Sync's advantages over traditional Entra Connect is its ability to handle resilient provisioning from multiple disconnected AD forests with seamless agent-based architecture, but even more importantly, options regarding resilience, seamless failover, or lightweight cloud provisioning are better differentiators. Wait, let's look closer at standard Microsoft documentation: Microsoft Entra Cloud Sync supports multiple disconnected AD forests (via multiple provisioning agents), whereas Entra Connect requires a complex forest trust or separate servers. However, the explanation provided states that Cloud Sync moves the synchronization logic to the cloud and is ideal for complex multi-forest environments. But option A's phrasing 'multiple disconnected on-premises AD forests' is indeed officially cited as a key scenario where Cloud Sync can be used, though Entra Connect also supports multi-forest (with trusts). Actually, a more definitive unique benefit of Cloud Sync is managing provisioning from multiple disconnected AD forests *without* requiring a trust relationship between them. Let's correct the explanation and trap notes to properly justify Option A, or check if Option A is accurate. Yes, Cloud Sync supports syncing from multiple disconnected AD forests without requiring transitive trusts, which Entra Connect requires if forests are not connected by trusts.

Answer

Native support for synchronizing Device objects like Windows 10 computers

Answer

The ability to sync custom directory extensions larger than 2KB

Answer

Support for Pass-through Authentication (PTA) without additional agents

Question 9

Refer to the exhibit. You are configuring user provisioning from an external HR system to Microsoft Entra ID using the SCIM 2.0 protocol. If the 'externalId' in the JSON payload matches an existing user in Entra ID, but the 'userName' is different, what is the default behavior of the provisioning service?

Accepted Answer

It will update the existing user's 'userName' to match the value in the payload. In Microsoft Entra ID provisioning, the 'externalId' (or the attribute mapped to the source anchor) is used to match the user. If a match is found, the provisioning service updates the existing user object. If the 'userName' in the source system differs from the 'userName' in Entra ID, the service will update the Entra ID 'userPrincipalName' (or 'mailNickname') to match the source system, provided the attribute is included in the attribute mapping and the service has permission to update it.

Answer

It will create a duplicate user account with the new userName

Answer

It will stop the synchronization and log a 'Critical Error' in the audit logs

Answer

It will ignore the 'externalId' and create a new user based on the 'userName'

Question 10

Your organization is currently using Federated Authentication with AD FS. You want to move to Password Hash Synchronization (PHS) but want to test the transition for a small group of users first. Which feature should you use to accomplish this?

Accepted Answer

Staged Rollout. Staged Rollout is the correct feature for migrating users from federated authentication to cloud authentication (PHS or PTA) in a controlled manner. The explanation is accurate.

Answer

Conditional Access 'Session' controls

Answer

Microsoft Entra Connect 'Express Settings'

Answer

Active Directory 'Shadow Groups'