SC-300 Implement and Manage User Identities — 25 Questions

Question 1

You are managing a Microsoft Entra ID tenant. You need to create a group that automatically includes all users from the Marketing department who are also located in the London office. If a user's department changes, they must be removed from the group automatically. Which group type and membership type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security group with Dynamic User membership. To automatically include users based on attributes (Department and Office), a Dynamic User membership is required. A Security group is the appropriate type for access control, whereas Microsoft 365 groups are primarily for collaboration. Dynamic User membership ensures that when a user's attributes change, they are automatically added or removed from the group based on the rule evaluation.

Answer

Security group with Assigned membership

Answer

Microsoft 365 group with Assigned membership

Answer

Microsoft 365 group with Dynamic Device membership

Question 2

A company plans to use Microsoft Entra B2B collaboration to work with several external partners. You need to configure the external collaboration settings to ensure that only users from the domain 'partner.com' can be invited. You also need to ensure that the external users cannot invite other guests. Which TWO settings should you configure?

Accepted Answer

Configure 'Collaboration restrictions' to 'Allow invitations only to the specified domains'. To prevent external users (guests) from inviting other guests, you must configure the 'Guest user access restrictions' setting in External collaboration settings to 'Guest users have limited access to features and objects in the directory' or specifically ensure the 'Guest invite settings' are configured to prevent guests from inviting others. Option D restricts internal users, which does not address the requirement regarding external users inviting others.

Answer

Set 'Guest user access' to 'Guest users have the same access as members'

Answer

Enable 'Self-service sign-up via user flows' for the tenant

Answer

Set 'Guest invite settings' to 'Only users assigned to specific admin roles can invite guest users'

Answer

Create a Cross-tenant access policy with 'Block all' for Inbound access

Question 3

Refer to the exhibit. You are using the Microsoft Graph API to create a new user account in Microsoft Entra ID. Based on the JSON payload provided, what will be the state of the user's password experience during their very first login attempt?

Accepted Answer

The user must change their password before they can access any resources. The passwordProfile object in the Microsoft Graph API contains the 'forceChangePasswordNextSignIn' property. When this is set to true in the JSON payload, the user is required to change their password upon their first successful authentication. The explanation should explicitly mention this property to justify why option B is correct.

Answer

The user will be prompted to set up Multi-Factor Authentication immediately

Answer

The user will be denied access because the password does not meet complexity requirements

Answer

The user will be logged in normally and can keep the temporary password indefinitely

Question 4

Your organization is implementing Self-Service Password Reset (SSPR). You want to ensure that users can only reset their passwords if they have registered at least two different authentication methods. Which configuration should you modify in the Microsoft Entra admin center to enforce this?

Accepted Answer

Number of methods required to reset in the SSPR properties. In the Microsoft Entra admin center, the setting is located under 'Password reset' > 'Authentication methods'. The specific setting is labeled 'Number of methods required to reset'. Option A is the correct functional setting, but the label provided in the option is slightly imprecise.

Answer

The 'Registration' tab in the Password Reset settings

Answer

The 'Combined security information registration' policy

Answer

Conditional Access policies for the 'My Profile' application

Question 5

Refer to the exhibit. An administrator creates a dynamic group rule for a management team. After 24 hours, several users with the job title 'Sales Manager' are not appearing in the group. What is the most likely cause for this behavior?

Accepted Answer

The Job Title attribute for those users is currently null or empty. The most likely cause is that the attribute value for the users does not match the rule criteria (e.g., a typo, extra spaces, or the attribute being null). Option C is the most plausible scenario for why specific users are excluded despite having the expected title. The explanation should explicitly state that dynamic group rules are case-insensitive, making A incorrect, and that there is no 1,000-member limit, making D incorrect.

Answer

The 'contains' operator is case-sensitive in dynamic group rules

Answer

The users have the 'accountEnabled' attribute set to false

Answer

Dynamic groups are limited to a maximum of 1,000 members

Question 6

You need to invite 50 external users from different organizations to a new project. You want to use the Microsoft Entra admin center to perform a bulk invite. Which TWO of the following are required to successfully complete this task?

Accepted Answer

A CSV file based on the 'Bulk invite users' template. To perform a bulk invite of external users in Microsoft Entra ID, you must download and use the specific CSV template ('Bulk invite users') and populate it with the user details. Furthermore, you need sufficient permissions; the account performing the bulk invite typically requires an administrative role such as User Administrator or Guest Inviter. (Note: Global Administrator also has this permission, though lesser privileged roles are recommended).

Answer

A JSON file containing the user display names and emails

Answer

An active subscription to Microsoft Entra ID P2

Answer

The 'Invite redirect URL' for each user in the upload file

Question 7

A user named Alex is a member of two groups: 'Group A' and 'Group B'. You assign a Microsoft 365 E5 license to 'Group A'. You then assign a Microsoft 365 E3 license to 'Group B'. Both groups have all license options enabled. What will be the resulting license state for Alex?

Accepted Answer

Alex will have both E5 and E3 licenses assigned. In Microsoft Entra ID, when a user is assigned multiple licenses via group-based licensing, the licenses are additive. However, if both licenses contain the same service plan (e.g., Exchange Online), the user does not consume two seats for that specific service; instead, the service plans are merged. The user will have both licenses assigned, and the resulting state is the union of all enabled service plans.

Answer

Alex will only have the E5 license as it is the higher SKU

Answer

The E3 license assignment will fail due to a license conflict

Answer

Alex will have the E5 license, and the E3 will be in a 'Suspended' state

Question 8

Your organization currently uses Microsoft Entra Connect to sync users from an on-premises Active Directory. You want to migrate to Microsoft Entra Cloud Sync for a specific subtree of users to simplify the infrastructure. Which of the following is a primary benefit of choosing Cloud Sync over Connect Sync?

Accepted Answer

Support for synchronizing from multiple disconnected on-premises AD forests. While Microsoft Entra Cloud Sync does support multiple disconnected AD forests, Microsoft Entra Connect (Sync) also supports multiple disconnected forests. A key primary benefit specifically highlighting Cloud Sync's advantages over traditional Entra Connect is its ability to handle resilient provisioning from multiple disconnected AD forests with seamless agent-based architecture, but even more importantly, options regarding resilience, seamless failover, or lightweight cloud provisioning are better differentiators. Wait, let's look closer at standard Microsoft documentation: Microsoft Entra Cloud Sync supports multiple disconnected AD forests (via multiple provisioning agents), whereas Entra Connect requires a complex forest trust or separate servers. However, the explanation provided states that Cloud Sync moves the synchronization logic to the cloud and is ideal for complex multi-forest environments. But option A's phrasing 'multiple disconnected on-premises AD forests' is indeed officially cited as a key scenario where Cloud Sync can be used, though Entra Connect also supports multi-forest (with trusts). Actually, a more definitive unique benefit of Cloud Sync is managing provisioning from multiple disconnected AD forests *without* requiring a trust relationship between them. Let's correct the explanation and trap notes to properly justify Option A, or check if Option A is accurate. Yes, Cloud Sync supports syncing from multiple disconnected AD forests without requiring transitive trusts, which Entra Connect requires if forests are not connected by trusts.

Answer

Native support for synchronizing Device objects like Windows 10 computers

Answer

The ability to sync custom directory extensions larger than 2KB

Answer

Support for Pass-through Authentication (PTA) without additional agents

Question 9

Refer to the exhibit. You are configuring user provisioning from an external HR system to Microsoft Entra ID using the SCIM 2.0 protocol. If the 'externalId' in the JSON payload matches an existing user in Entra ID, but the 'userName' is different, what is the default behavior of the provisioning service?

Accepted Answer

It will update the existing user's 'userName' to match the value in the payload. In Microsoft Entra ID provisioning, the 'externalId' (or the attribute mapped to the source anchor) is used to match the user. If a match is found, the provisioning service updates the existing user object. If the 'userName' in the source system differs from the 'userName' in Entra ID, the service will update the Entra ID 'userPrincipalName' (or 'mailNickname') to match the source system, provided the attribute is included in the attribute mapping and the service has permission to update it.

Answer

It will create a duplicate user account with the new userName

Answer

It will stop the synchronization and log a 'Critical Error' in the audit logs

Answer

It will ignore the 'externalId' and create a new user based on the 'userName'

Question 10

Your organization is currently using Federated Authentication with AD FS. You want to move to Password Hash Synchronization (PHS) but want to test the transition for a small group of users first. Which feature should you use to accomplish this?

Accepted Answer

Staged Rollout. Staged Rollout is the correct feature for migrating users from federated authentication to cloud authentication (PHS or PTA) in a controlled manner. The explanation is accurate.

Answer

Conditional Access 'Session' controls

Answer

Microsoft Entra Connect 'Express Settings'

Answer

Active Directory 'Shadow Groups'

Question 11

You are configuring Self-Service Password Reset (SSPR) for your organization. You want to provide users with the maximum variety of authentication methods. Which THREE of the following are valid authentication methods available for SSPR in Microsoft Entra ID?

Accepted Answer

Security questions. Microsoft Entra ID SSPR supports Mobile app notification, Mobile app code, Email, Mobile phone, and Office phone. Security questions are a legacy method that is not recommended and often disabled, but technically available; however, FIDO2 security keys are NOT supported for SSPR. Smart cards are also not a supported SSPR method.

Answer

Smart cards

Answer

FIDO2 security keys

Question 12

You are implementing group-based licensing in Microsoft Entra ID. You assign a Microsoft 365 E5 license to 'GroupA'. User1 is a member of 'GroupA' but already has a Microsoft 365 E3 license assigned directly. What happens to User1's licenses?

Accepted Answer

The E5 license assignment will fail for User1 because of a license conflict with the existing E3 license.. When a user has a direct license (E3) and is assigned a conflicting license (E5) via a group, the group-based license assignment will enter a 'Conflict' state. The E5 license will not be successfully assigned to the user until the conflicting E3 license is removed. The user will not have both licenses active simultaneously in the way described.

Answer

User1 will have both the E3 and E5 licenses assigned, and all services from both will be available.

Answer

The direct E3 license is automatically removed, and only the group-based E5 license remains.

Answer

The E5 license is assigned, but all its services are disabled until the E3 license is manually removed.

Question 13

Refer to the exhibit. An administrator is using the Microsoft Graph PowerShell SDK to create a new user. Which additional step must be taken if the administrator wants this user to be prompted to change their password at the first sign-in?

Accepted Answer

Set the 'ForceChangePasswordNextSignIn' property to true within the $passwordProfile object.. To force a password change at first sign-in using the Microsoft Graph PowerShell SDK, you must define a PasswordProfile object using New-MgObjectPasswordProfile and set the ForceChangePasswordNextSignIn property to $true, then pass this object to the -PasswordProfile parameter of the New-MgUser command.

Answer

Add the parameter -ForceChangePasswordNextSignIn $true to the New-MgUser command.

Answer

Run the command Set-MgUserPassword -UserId "tuser@contoso.com" -ForceChange $true after creation.

Answer

The user will automatically be prompted to change their password because 'AccountEnabled' is set to true.

Question 14

You are implementing Entra ID Password Protection for your on-premises Active Directory Domain Services (AD DS) environment. Which TWO components must be installed on your on-premises servers?

Accepted Answer

Microsoft Entra ID Password Protection Proxy. Entra ID Password Protection extends the cloud-based banned password list to your local Active Directory. This ensures a consistent security policy across hybrid environments. Understanding the architecture, specifically the role of the Proxy and the DC Agent, is crucial for a successful deployment that protects local accounts from weak or compromised passwords.

Answer

Microsoft Entra Connect Sync Engine

Answer

Microsoft Entra Application Proxy Connector

Answer

Microsoft Entra Connect Health Agent

Question 15

An administrator accidentally deletes a cloud-only user account from the Microsoft Entra admin center. How many days does the administrator have to restore the user account before it is permanently deleted?

Accepted Answer

30 days. Microsoft Entra ID implements a 'soft-delete' state for deleted users, providing a safety net for accidental deletions. Knowing the exact duration of this window is fundamental for identity recovery operations. After this period, the object and its associated data are purged and cannot be recovered through standard administrative tools.

Answer

7 days

Answer

14 days

Answer

90 days

Question 16

Your company wants to use B2B Direct Connect to collaborate with a partner organization in a Microsoft Teams shared channel. Which of the following is a strict requirement for B2B Direct Connect to function?

Accepted Answer

Both organizations must configure mutual trust in their Cross-tenant access settings.. B2B Direct Connect is a specialized form of collaboration that removes the need for guest accounts. It is built on mutual trust between two Microsoft Entra tenants. Understanding the specific configuration requirements, such as the need for both organizations to configure cross-tenant access settings, is vital for enabling seamless, high-performance collaboration in Teams.

Answer

The external users must be invited as guests to the host tenant first.

Answer

All users in the partner organization must have a Microsoft Entra ID P2 license.

Answer

The partner organization must use a third-party identity provider like Okta or Google.

Question 17

Your organization has a hybrid environment with Microsoft Entra Connect syncing on-premises Active Directory users to the cloud. You need to update the 'Department' attribute for a synchronized user. When you attempt to change this in the Microsoft Entra admin center, the field is grayed out. What is the most appropriate action to resolve this?

Accepted Answer

Modify the attribute in the on-premises Active Directory and wait for the next synchronization cycle.. Managing user identities in a hybrid environment requires understanding where the source of authority resides for specific objects. When accounts are synchronized from on-premises Active Directory to Microsoft Entra ID, most attributes cannot be modified directly in the cloud portal. This ensures data consistency across the hybrid identity infrastructure and prevents synchronization conflicts that could disrupt user access.

Answer

Assign the User Administrator role to your account to override the synchronization lock.

Answer

Disable the Microsoft Entra Connect sync temporarily to allow direct edits in the cloud portal.

Answer

Use the Microsoft Graph PowerShell module to force the attribute update in the cloud.

Question 18

You are configuring a dynamic group in Microsoft Entra ID to automatically include users from the 'Sales' and 'Marketing' departments who are also based in 'London'. Which membership rule syntax should you use to ensure the group updates correctly?

Accepted Answer

(user.department -eq "Sales" -or user.department -eq "Marketing") -and (user.city -eq "London"). Option B is correct because it uses the logical 'OR' operator to group the departments, ensuring a user in either Sales or Marketing is included, and the 'AND' operator to ensure they must also be in London. Option A is incorrect because a user cannot be in two departments simultaneously. Option C is syntactically invalid. Option D uses an unsupported syntax for the -in operator.

Answer

(user.department -eq "Sales" -and user.department -eq "Marketing") -and (user.city -eq "London")

Answer

user.department -contains "Sales" -or "Marketing" -and user.city -match "London"

Answer

user.department -in ["Sales", "Marketing"] -or user.city -eq "London"

Question 19

You need to perform a bulk upload of 500 new employees into Microsoft Entra ID using a CSV file. Which TWO columns are mandatory in the CSV file for the 'Bulk create users' operation to succeed?

Accepted Answer

User name [userName]. When performing a bulk create operation in Microsoft Entra ID, the CSV template requires the 'User name' (User principal name) to identify the account and the 'Initial password' to satisfy the security requirement for account creation. Other fields like Job title, Usage location, and Department are optional attributes.

Answer

Job title [jobTitle]

Answer

Usage location [usageLocation]

Answer

Department [department]

Question 20

A user is a member of two groups: 'Group A' has a Microsoft 365 E3 license assigned, and 'Group B' has a Microsoft 365 E5 license assigned. The user is currently only showing features for E3. What is the most likely reason for this behavior?

Accepted Answer

There is a license assignment error on the user object due to conflicting service plans.. Microsoft Entra ID group-based licensing allows for efficient management of service plans, but conflicts can arise when multiple licenses are assigned to the same user. Understanding how license stacking and service plan conflicts work is essential for troubleshooting access issues and ensuring that users have the correct tools for their job roles.

Answer

License assignments in Entra ID always prioritize the license that was assigned first chronologically.

Answer

The user has not yet signed out and signed back in to refresh their license token.

Answer

The E5 license requires a manual 'Usage Location' update that the E3 license does not.