What's inside
SC-300 doesn't test whether you can memorise menu paths. It tests whether you can choose the right role, sync option, authentication method, Conditional Access control, app identity or governance feature for an identity requirement in Microsoft Entra.
This independent study guide for the Microsoft Certified: Identity and Access Administrator Associate exam distils what SC-300 really expects you to understand into the comparisons, configuration choices, licence requirements and traps that identity decisions turn on, with short PowerShell and KQL examples throughout.
Organised by technology
Twelve chapters, each readable on its own and together covering all four SC-300 skill areas:
- User identities: tenants, built-in and custom roles, administrative units, domains, branding and tenant settings; users, groups, custom security attributes, bulk operations, devices and licences; external collaboration, cross-tenant access settings, cross-tenant synchronization and SAML/WS-Fed identity providers; Connect Sync, Cloud Sync, password hash sync, pass-through authentication, seamless SSO, AD FS migration and Connect Health.
- Authentication and access: the Authentication methods policy, Microsoft Authenticator, passkeys (FIDO2), certificate-based authentication, Temporary Access Pass, security defaults, SSPR, Password Protection, Windows Hello for Business and Microsoft Entra Kerberos; Conditional Access assignments, grant and session controls, continuous access evaluation, authentication context and protected actions; ID Protection user and sign-in risk; Global Secure Access, Private Access and Internet Access.
- Workload identities: managed identities, service principals, enterprise application settings and roles, consent, Application Proxy, SaaS single sign-on and provisioning, app registrations, API permissions and app roles; Defender for Cloud Apps cloud discovery, connected apps, Conditional Access app control and OAuth app policies.
- Identity governance: entitlement management catalogs, access packages, terms of use and connected organisations; access reviews; Privileged Identity Management for roles, Azure resources and groups; emergency access accounts; sign-in, audit and provisioning logs, diagnostic settings, KQL, workbooks and Identity Secure Score.
Inside
- Comparison tables for every close call, such as which sync engine, which MFA approach, which managed identity type or which PIM assignment fits a requirement.
- 140 Common trap callouts that name the answers that look right but aren't, and explain what's right instead.
- 11 diagrams, from role assignment scope and cross-tenant access to Conditional Access evaluation, Global Secure Access, Application Proxy and the PIM assignment timeline.
- Key takeaways at the end of every chapter for fast revision.
- A glossary of more than 400 terms, each linked to Microsoft Learn, with a free online version for print readers.
Up to date
Microsoft Entra changes quickly. This edition reflects Microsoft's documentation as of October 2026 and uses the current names: Microsoft Entra ID (formerly Azure Active Directory), Microsoft Entra Connect Sync (formerly Azure AD Connect), Microsoft Entra ID Protection (formerly Azure AD Identity Protection), PIM for Groups (formerly Privileged Access Groups) and target resources (formerly cloud apps or actions).
Understanding, not memorising
This book contains no exam questions. It explains the knowledge the exam expects, so you can answer questions you have never seen and apply the same judgement to real identity platforms.
Written by Tony Rough, a cloud architect with more than twenty years in IT infrastructure who holds the Azure Solutions Architect Expert, Azure Administrator and Azure Security Engineer certifications.
Part of the Ultra Transcenders series from Distilled Press. An independent publication, not affiliated with, sponsored by or endorsed by Microsoft Corporation.
