What the Microsoft SC-300 is and who it is for
The SC-300 is the exam for Microsoft’s Identity and Access Administrator certification. It validates that you can implement and manage identity and access solutions with Microsoft Entra ID, including conditional access, Privileged Identity Management, workload identities, identity governance and hybrid identity. This guide follows the skills measured as of 27 April 2026.
It is a core certification for people who work in Microsoft cloud security, and a natural step towards SC-200 and SC-100. It is for you if you administer Entra ID tenants, if you are responsible for sign in, multifactor authentication and access policies in a Microsoft environment, or if you manage application access and privileged roles and want a credential that proves it.
The certification renews annually, for free, through an assessment on Microsoft Learn, so once you pass you keep it current without sitting the full exam again.
Microsoft SC-300 at a glance
| Item | Detail |
|---|---|
| Exam code | SC-300 |
| Questions | 40 to 60 |
| Time allowed | 100 minutes |
| Passing score | 700 on a scale of 1000 |
| Exam fee | US$165 in the US, priced in local currency elsewhere |
| Certification valid for | Renews annually through a free Microsoft Learn assessment |
What is on the exam
Four domains, weighted in ranges. Authentication and access management is the largest, and the other three are close to equal, so there is no domain you can safely leave until last.
Implement and manage user identities (20 to 25%). Configuring an Entra ID tenant, creating and managing users, groups and administrative roles, managing external identities and guest collaboration with other organisations, and hybrid identity: synchronising on premises directories with the cloud and choosing the right sign in method for a hybrid setup. Expect scenarios that ask which synchronisation or authentication approach meets a stated requirement.
Implement authentication and access management (25 to 30%). The largest domain. Authentication methods, multifactor authentication, passwordless options and self service password reset, then conditional access policies and risk based protection. Questions often describe an organisation’s requirement and ask which combination of policy conditions, controls and exclusions delivers it without locking people out.
Plan and implement workload identities (20 to 25%). Identities for software rather than people: service principals, managed identities, app registrations and enterprise applications, consent and permissions, and workload identity federation. This is now a domain in its own right, carrying as much weight as user identity management.
Plan and automate identity governance (20 to 25%). Entitlement management and access packages, access reviews, Privileged Identity Management for just in time role activation, lifecycle management, and monitoring through sign in and audit logs. The exam tests how you would design governance for a scenario, not just where each setting lives.
Why people fail it
The SC-300 is heavily scenario based, and it consistently tests whether you know Microsoft’s recommended approach, not just whether you know the technology. A candidate who runs Entra ID every day can still fail, because the way their organisation does something is not necessarily the way Microsoft wants it done. When two options would both work, the exam wants the one that follows Microsoft’s guidance, often the one with the least privilege or the least administrative overhead.
The blueprint catches people too. Workload identities are now a full domain at 20 to 25%, and candidates who prepare from older material treat service principals, managed identities and workload identity federation as a footnote inside application access. They are not. They carry as much weight as user identity management, and they are an area many administrators rarely touch.
Finally, the detail. Conditional access, Privileged Identity Management and access reviews each have edge cases: exclusions, assignment types, activation settings, reviewer options. Questions turn on those details, and general familiarity is not enough to separate two plausible answers. Most preparation comes from Microsoft Learn modules, which explain features well but do not show you how the exam words its scenarios.
A study plan that fits the exam
Six weeks: two for the largest domain, one each for the other three, and a final week of timed practice. Work in a test tenant wherever you can, because clicking through a policy teaches you more than reading about it.
- Week 1: user identities. Tenant configuration, users, groups, roles, external collaboration and hybrid synchronisation. At the end of the week, try the free SC-300 practice questions to see how Microsoft frames its scenarios.
- Week 2: authentication. Authentication methods, multifactor authentication, passwordless sign in and self service password reset. Learn which method suits which requirement.
- Week 3: access management. Conditional access policies, conditions, grant and session controls, exclusions and risk based policies. Build several policies in a test tenant and check what the sign in logs show.
- Week 4: workload identities. Service principals, managed identities, app registrations, enterprise applications, consent and workload identity federation. Work these questions in the SC-300 practice question pack and read every explanation, including why the wrong options are wrong.
- Week 5: identity governance. Entitlement management, access reviews, Privileged Identity Management, lifecycle management and monitoring. Pay attention to the settings that differ between similar features.
- Week 6: timed runs. Use the questions only PDF for full sittings against the 100 minute limit, score by domain, and spend the final days on the weakest one.
On exam day
Book through Microsoft’s exam page and check the delivery options, identification rules and any system requirements there before the day. If you sit online, run the system test on the computer you will use, in the room you will use.
You have 100 minutes for 40 to 60 questions. That is enough if you keep a steady pace, but scenario questions take time to read properly, so do not linger on the first half and then rush the end. Read each requirement carefully, because small words such as “minimise” or “least” usually decide the answer. The passing score is 700 on a scale of 1000. It is a scaled score, not a percentage, so do not try to work out your mark as you go.
Frequently asked questions
How do I keep the certification current?
It renews annually, for free, through an online assessment on Microsoft Learn. You do not pay the exam fee again to renew, but you do need to complete the assessment each year to keep the certification active.
What happens if I fail? Can I retake it?
You can retake it, but each attempt costs the exam fee again, US$165 in the US or the local price elsewhere, plus the weeks it takes to prepare again. Microsoft publishes its retake policy, including any waiting period between attempts, on its website, so check it before you rebook. The practice pack is refunded if you fail, but the exam fee is not.
What should I take after SC-300?
SC-300 is a natural step towards SC-200 and SC-100. Which you choose depends on whether your work leans towards security operations or towards security architecture.
Is the practice question pack enough on its own?
No. It is 463 practice questions mapped to the SC-300 objectives across all four domains, with an explanation for every answer and why each wrong option is wrong. It shows you how the exam frames its scenarios and where your gaps are. It is not a course, and it does not replace Microsoft Learn or time spent configuring a real tenant. Use it alongside both.
When you are ready to practise, get the 463 question SC-300 pack for US$39, pass or your money back.