SC-300 · Identity test

Administrative units scope supported Microsoft Entra roles to a defined set of users, groups or devices.

Custom security attributes are business-specific key/value attributes assigned to Entra objects and can support attribute-based access control.

B2B collaboration invites external identities and represents them in the resource tenant without a separate local password identity.

Cross-tenant synchronization automates the lifecycle of B2B collaboration users between Entra tenants.

Password hash synchronization allows Entra to authenticate in the cloud without a real-time dependency on on-premises agents or domain controllers.

Cloud Sync uses provisioning agents and cloud configuration. The choice depends on supported topology and feature requirements.

Temporary Access Pass is a time-limited code for onboarding and registration of passwordless authentication methods.

FIDO2 passkeys are bound to the correct origin and considered phishing-resistant. SMS and passwords offer weaker phishing resistance.

Report-only evaluates without enforcement. Results appear in sign-in logs for analysis before activation.

Emergency access accounts should avoid the same failure mode as normal access but remain strictly secured and monitored.

Sign-in risk applies to the individual sign-in. User risk describes the probability that the identity itself is compromised.

CAE lets supported services react quickly to events such as disabled accounts or changed risk and enforce policy before normal token expiry.

A system-assigned managed identity is created on the resource and deleted with it. It can receive Storage RBAC access.

A user-assigned managed identity is a standalone Azure resource that can attach to several workloads and has its own lifecycle.

Delegated permissions apply when the app acts for a signed-in user. Application permissions serve daemon or service scenarios without a user.

App roles are defined on the application and assigned to users, groups or service principals. Assigned roles appear in the roles claim.

Application permissions and highly privileged delegated permissions normally require administrator consent because they can grant broad access.

Application Proxy uses an outbound connector and supports Entra preauthentication and Conditional Access.

Entra user consent settings can restrict consent by verified publisher and permissions classified as low impact.

Access packages bundle resource access with request policy, approval, duration and lifecycle in entitlement management.

Access reviews periodically ask users or owners to confirm memberships, app access or role needs and can apply the results.

PIM eligible assignments grant the right to activate. Activation settings control duration, MFA, justification and approval.

PIM for Groups governs eligible and active membership or ownership in security and Microsoft 365 groups.

Entra diagnostic settings export sign-in, audit, provisioning and other logs to Log Analytics, Storage or Event Hubs.

Entitlement management configures what happens to external users when their last access package assignment expires, including block and later deletion.