FirstTry

Exam objective

SC-300

Plan, implement, and manage Microsoft Entra user authentication

This objective sits in Implement authentication and access management, which carries 28% of the Identity and Access Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.

Objective title verbatim from the official objectives. Microsoft Azure exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Implement authentication and access management

A security administrator wants sign-ins automatically challenged for multifactor authentication whenever Microsoft Entra ID Protection evaluates a sign-in as medium or high risk. Which capability should the administrator configure to achieve this?

Create a custom Azure role definition with a wildcard action and a deny assignmentCustom role definitions and deny assignments are RBAC authorization concepts, unrelated to sign-in risk detection.
Assign the Contributor role to the user at the subscription scope in Azure RBACContributor role assignment is an Azure RBAC concept for managing resource access, not a way to trigger MFA on risk.
Deploy Microsoft Entra Domain Services to enforce Kerberos authenticationDomain Services enables Kerberos and NTLM for legacy apps and has no role in risk-based sign-in evaluation.
Configure a risk-based Conditional Access policy in Microsoft Entra ID ProtectionCorrect · your answerCorrect: risk level in, step-up challenge out.

Correct.

Checked against learn.microsoft.com, July 2026

Concept

Authorization controls and authentication controls answer different questions, and a question about what happens at sign-in is never solved by a permission grant. Deciding what a principal may do to a resource is one axis. Deciding whether the person at the keyboard should be challenged again before anything is granted is the other, and only that axis can consume a probability score about the sign-in itself.

Why D

Sign-in risk becomes actionable only when a policy names it as a condition. A risk-based Conditional Access policy reads the level Microsoft Entra ID Protection calculates and attaches a grant control to it, so a medium or high score produces a multifactor challenge without an administrator intervening.

Source

Administrators can investigate and automatically remediate risks using tools like risk-based Conditional Access policies. Scenario: Create risk-based Conditional Access policies that require multifactor authentication when the sign-in risk level is medium or high.

What is Microsoft Entra ID, checked July 2026
#entra-id-protection#conditional-access#mfa#risk-based-policy

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Implement authentication and access management

An organization is moving a line-of-business application to the cloud. The application only supports Kerberos and NTLM and cannot use modern authentication methods. Which action should the identity administrator take so the application keeps functioning after the move?

Sample question 2 of 3

Implement authentication and access management

What is the stated purpose of self-service password reset for an organization?

Sample question 3 of 3

Implement authentication and access management

With single sign-on in place and Microsoft Entra ID as the identity provider, what changes for the applications involved?

Full Identity and Access Admin question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Implement authentication and access management