FirstTry

Exam objective

SC-300

Plan and implement privileged access

This objective sits in Plan and automate identity governance, which carries 28% of the Identity and Access Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.

Objective title verbatim from the official objectives. Microsoft Azure exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Plan and automate identity governance

An administrator wants to grant a marketing group Contributor access only within one resource group in Azure. To create this role assignment, which three elements must the administrator define together?

A security principal, a role definition, and a scope for the assignmentCorrect · your answerCorrect: this matches the three elements that make up every role assignment.
A security principal, a deny assignment, and a scope for the assignmentDeny assignments are a separate mechanism evaluated during access checks; they are not one of the three elements that define a role assignment.
A role definition, a condition, and a management group for the assignmentConditions are optional additions to a role assignment, and a management group is only one specific level of scope, not scope itself.
A security principal, a role definition, and a resource for the assignmentA resource is only one of four possible scope levels; the general element required is scope, which can also be a resource group, subscription, or management group.

Correct.

Checked against learn.microsoft.com, July 2026

Concept

Grants in Azure are built from three answers, and each of the three is a separate choice: who, what, and where. Conditions, deny rules and particular levels of the resource hierarchy all exist, but they are refinements or instances rather than the structural parts. A question asking what must be defined together is asking for the parts, not for one legal value of a part.

Why A

The scenario describes attaching a role definition to a security principal (the marketing group) at a particular scope (the resource group), which matches the three required elements exactly.

Source

A role assignment consists of three elements: security principal, role definition, and scope.

Azure RBAC overview, checked July 2026
#azure-rbac#role-assignment#privileged-access#scope

Now you: practice questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Plan and automate identity governance

A cloud administrator wants the Marketing group to manage resources only inside the pharma-sales resource group, and no resources outside it. Which three components together form the Azure RBAC role assignment needed to achieve this?

Sample question 2 of 3

Plan and automate identity governance

A user is assigned the Contributor role at the subscription scope and the Reader role on one resource group within that subscription. What are the user's effective permissions on resources inside that resource group?

Sample question 3 of 3

Plan and automate identity governance

Which resources can Privileged Identity Management govern access to?

Full Identity and Access Admin question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Plan and automate identity governance