SC-300 Implement and Manage User Identities Practice Question
You need to store specialized metadata for users in Microsoft Entra ID that is not available in the standard user profile attributes. This metadata must be accessible via the Microsoft Graph API and must support fine-grained access control so only specific administrators can read or write the data. Which THREE steps are required to implement Custom Security Attributes?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the Attribute Definition Administrator role
Custom security attributes offer a way to extend the user schema with highly secure, controlled data. Unlike extension attributes, these support RBAC for the attributes themselves. This allows sensitive data, like employee IDs or clearance levels, to be stored on the user object while strictly limiting who can interact with that specific metadata.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the Attribute Definition Administrator role
Why this is correct
To create and manage the structure of custom security attributes, a user must have the Attribute Definition Administrator role. This role is distinct from Global Administrator, ensuring that attribute schema management is a delegated, specific task that follows the principle of least privilege within the Microsoft Entra ID environment.
- ✗
Configure a new Schema Extension using the Azure AD Graph API
Why it's wrong here
The Azure AD Graph API is deprecated and does not support the modern Custom Security Attributes feature. Furthermore, Schema Extensions are a different technology used for application-specific data and do not provide the built-in RBAC and administrative separation that is characteristic of the Custom Security Attributes management framework.
- ✓
Define an Attribute Set
Why this is correct
An Attribute Set is a mandatory grouping for custom security attributes. It serves as the container for related attributes and, more importantly, provides the boundary for assigning permissions. You cannot create an individual attribute without first defining the set it belongs to, which organizes the metadata logically.
- ✗
Create a new Directory Extension in Microsoft Entra Connect
Why it's wrong here
Directory extensions in Microsoft Entra Connect are used to sync custom attributes from an on-premises Active Directory to the cloud. While they extend the schema, they do not support the advanced RBAC features of Custom Security Attributes and are managed through the sync engine rather than the cloud-native attribute UI.
- ✓
Add Attribute Definitions to the Attribute Set
Why this is correct
After creating the set, you must define the specific attributes (definitions) that will store the data. This includes naming the attribute and selecting its data type (e.g., Boolean, Integer, or String). This step establishes the actual fields that will be available on the user objects for data entry.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
One of 17 original SC-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-300 exam.