Free Microsoft SC-300 Practice Questions & Answers 2026 Part2

You have a Microsoft 365 tenant that uses the domain named fabrikam.com. The Guest invite settings for Azure Active Directory (Azure AD) are configured asshown in the exhibit. (Click the Exhibit tab.)A user named[email protected]shares a Microsoft SharePoint Online document library to the users shown in the following table.Which users will be emailed a passcode?

You have an Azure Active Directory Premium P2 tenant. You create a Log Analytics workspace. You need to ensure that you can view Azure Active Directory (Azure AD) audit log information by using Azure Monitor. What should you do first?

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.From the Groups blade in the Azure Active Directory admin center, you assign Microsoft Office 365 Enterprise E5 licenses to a group that includes all users.You needed to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.What should you use?

Case StudyOverviewADatum Corporation is a consulting company in Montreal.ADatum recently acquired a Vancouver-based company named Litware, Inc.Existing Environment. ADatum EnvironmentThe on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.ADatum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS domain by using Azure AD Connect.ADatum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.The tenant contains the users shown in the following table.The tenant contains the groups shown in the following table.Existing Environment. Litware EnvironmentLitware has an AD DS forest named litware.comExisting Environment. Problem StatementsADatum identifies the following issues:• Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device limit.• A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address.• When you attempt to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list.• Anyone in the organization can invite guest users, including other guests and non-administrators.• The helpdesk spends too much time resetting user passwords.• Users currently use only passwords for authentication.Requirements. Planned ChangesADatum plans to implement the following changes:• Configure self-service password reset (SSPR).• Configure multi-factor authentication (MFA) for all users.• Configure an access review for an access package named Package1.• Require admin approval for application access to organizational data.• Sync the AD DS users and groups of litware.com with the Azure AD tenant.• Ensure that only users that are assigned specific admin roles can invite guest users.• Increase the maximum number of devices that can be joined or registered to Azure AD to 10.Requirements. Technical RequirementsADatum identifies the following technical requirements:• Users assigned the User administrator role must be able to request permission to use the role when needed for up to one year.• Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.• Users must provide one authentication method to reset their password by using SSPR. Available methods must include:- Email- Phone- Security questions- The Microsoft Authenticator app• Trust relationships must NOT be established between the adatum.com and litware.com AD DS domains.• The principle of least privilege must be used.You need to implement the planned changes for litware.com.What should you configure?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a Microsoft 365 tenant. All users must use the Microsoft Authenticator app for multi-factor authentication (MFA) whenaccessing Microsoft 365 services. Some users report that they received an MFA prompt on their Microsoft Authenticator app without initiating a sign-in request. You need to block the users automatically when they report an MFA request that they did not initiate. Solution: From the Azure portal, you configure the Notifications settings for multi-factor authentication (MFA). Does this meet the goal?

You have a Microsoft 365 E5 subscription. Users authorize third-party cloud apps to access their data. You need to configure an alert that will be triggered when an app requires high permissions and is authorized by more than 20 users. Which type of policy should you create in the Microsoft Defender for Cloud Apps portal? According to Microsoft Defender for Cloud Apps documentation and the SC-300 study guide, an OAuth app policy monitors third-party applications that request access to Microsoft 365 data through Microsoft Graph API permissions. These apps can request delegated or application permissions. When an app is authorized by many users and requests high permissions such as Calendars.ReadWrite, it can introduce security risks. Defender for Cloud Apps allows administrators to create OAuth app policies to generate alerts when an app: Requires high permissions (e.g., read/write to mailboxes, calendars, or files). Is authorized by more than a specified number of users (for example, more than 20). This matches the requirement in the question exactly. Other policy types (anomaly detection, access, or activity) monitor user or session behavior, not app consent behavior. As per Microsoft's documentation: ''Use OAuth app policies to detect risky OAuth apps, monitor application permissions, and alert when apps are authorized by an unusual number of users or request excessive permissions.''

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Active Directory (Azure AD) tenant that syncs to an Active Directory forest.You discover that when a user account is disabled in Active Directory, the disabled user can still authenticate to Azure AD for up to 30 minutes.You need to ensure that when a user account is disabled in Active Directory, the user account is immediately prevented from authenticating to Azure AD.Solution: You configure conditional access policies.Does this meet the goal?

You have a Microsoft Entra tenant named contoso.com that contains an enterprise application named App1.A contractor uses the credentials of user1@outlook.com.You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as user1@outlook.com.What should you do?

Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by using Azure AD Connect. You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync. What should you do in Azure AD Connect? In Azure AD Connect, filtering which users synchronize is achieved via synchronization rules. The SC-300 study content explains that to exclude objects based on an on-premises attribute (for example, extensionAttribute15=NoSync), you create an inbound rule on the Active Directory Domain Services (AD DS) connector. Inbound rules control the flow of data from AD DS into the metaverse, where you can use a scoping filter to mark objects as filtered (often via the cloudFiltered projection), preventing them from being provisioned to Azure AD. The official guidance highlights that inbound rules on the AD DS connector are used for attribute-based filtering and that export or run profiles (Full Import/Export) do not define logic; they only execute the configured rules. Therefore, to stop users with extensionAttribute15=NoSync from syncing, you create an inbound synchronization rule on the AD DS connector with a condition on that attribute to exclude those users from synchronization.

You have a Microsoft Entra tenant.

You have 2,500 users who are assigned Microsoft Office 365 Enterprise E3 licenses. The licenses are assigned to individual users.From the Groups blade in the Azure Active Directory admin center, you assign Microsoft 365 Enterprise E5 licenses to a group that includes all the users.You need to remove the Office 365 Enterprise E3 licenses from the users by using the least amount of administrative effort.What should you use?

You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains an Azure AD enterprise application named App1.A contractor uses the credentials of user1@outlook.com.You need to ensure that you can provide the contractor with access to App1. The contractor must be able to authenticate as user1@outlook.com.What should you do?

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.You create a dynamic user group and configure the following rule syntax.user.usageLocation -in ["US","AU"] -and (user.department -eq "Sales") -and -not (user.jobTitle -eq "Manager") –or (user. jobTitle -eq "SalesRep")Which users will be added to the group?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft 365 E5 subscription.You create a user named User1.You need to ensure that User1 can update the status of Identity Secure Score improvement actions.Solution: You assign the User Administrator role to User1.Does this meet the goal?

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com.Several users use their contoso.com email address for self-service sign-up to Azure Active Directory (Azure AD).You gain global administrator privileges to the Azure AD tenant that contains the self-signed users.You need to prevent the users from creating user accounts in the contoso.com Azure AD tenant for self-service sign-up to Microsoft 365 services.Which PowerShell cmdlet should you run?

You have an Azure Active Directory (Azure AD) Azure AD tenant.You need to bulk create 25 new user accounts by uploading a template file.Which properties are required in the template file?

Your network contains an Active Directory forest named contoso.com that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com by usingAzure AD Connect.You need to prevent the synchronization of users who have the extensionAttribute15 attribute set to NoSync.What should you do in Azure AD Connect?

You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.Which objects can you add as members to Group3?

You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint Online site named Site1.You need to enable Microsoft Defender for Cloud Apps session control for Site1.Which type of policy should you create first?

You have a Microsoft 365 tenant that uses the domain named fabrikam.com. The Guest invite settings for Azure Active Directory (Azure AD) are configured as shown in the exhibit. (Click the Exhibit tab.)A user named[email protected]shares a Microsoft SharePoint Online document library to the users shown in the following table.Which users will be emailed a passcode?

You have an Azure AD tenant that contains a user named User1 and a Microsoft 365 group named Group1. User1 is the owner of Group1.You need to ensure that User1 is notified every three months to validate the guest membership of Group1.What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft 365 E5 subscription.You create a user named User1.You need to ensure that User1 can update the status of Identity Secure Score improvement actions.Solution: You assign the Security Operator role to User1.Does this meet the goal?

Case StudyOverviewADatum Corporation is a consulting company in Montreal.ADatum recently acquired a Vancouver-based company named Litware, Inc.Existing Environment. ADatum EnvironmentThe on-premises network of ADatum contains an Active Directory Domain Services (AD DS) forest named adatum.com.ADatum has a Microsoft 365 E5 subscription. The subscription contains a verified domain that syncs with the adatum.com AD DS domain by using Azure AD Connect.ADatum has an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant has Security defaults disabled.The tenant contains the users shown in the following table.The tenant contains the groups shown in the following table.Existing Environment. Litware EnvironmentLitware has an AD DS forest named litware.comExisting Environment. Problem StatementsADatum identifies the following issues:• Multiple users in the sales department have up to five devices. The sales department users report that sometimes they must contact the support department to join their devices to the Azure AD tenant because they have reached their device limit.• A recent security incident reveals that several users leaked their credentials, a suspicious browser was used for a sign-in, and resources were accessed from an anonymous IP address.• When you attempt to assign the Device Administrators role to IT_Group1, the group does NOT appear in the selection list.• Anyone in the organization can invite guest users, including other guests and non-administrators.• The helpdesk spends too much time resetting user passwords.• Users currently use only passwords for authentication.Requirements. Planned ChangesADatum plans to implement the following changes:• Configure self-service password reset (SSPR).• Configure multi-factor authentication (MFA) for all users.• Configure an access review for an access package named Package1.• Require admin approval for application access to organizational data.• Sync the AD DS users and groups of litware.com with the Azure AD tenant.• Ensure that only users that are assigned specific admin roles can invite guest users.• Increase the maximum number of devices that can be joined or registered to Azure AD to 10.Requirements. Technical RequirementsADatum identifies the following technical requirements:• Users assigned the User administrator role must be able to request permission to use the role when needed for up to one year.• Users must be prompted to register for MFA and provided with an option to bypass the registration for a grace period.• Users must provide one authentication method to reset their password by using SSPR. Available methods must include:- Email- Phone- Security questions- The Microsoft Authenticator app• Trust relationships must NOT be established between the adatum.com and litware.com AD DS domains.• The principle of least privilege must be used.You need to resolve the issue of the sales department users.What should you configure for the Azure AD tenant?

You have an Active Directory forest that syncs to an Azure Active Directory (Azure AD) tenant. The tenant uses pass-through authentication.A corporate security policy states the following:-Domain controllers must never communicate directly to the internet.-Only required software must be installed on servers.The Active Directory domain contains the on-premises servers shown in the following table.You need to ensure that users can authenticate to Azure AD if a server fails.On which server should you install an additional pass-through authentication agent?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You need to resolve the issue of the guest user invitations. What should you do for the Azure AD tenant?

You have a Microsoft 365 subscription.You need to ensure that users can grant enterprise applications access to their profile. The solution must ensure that the users can consent only to the User. Read and profile delegated permissions.What should you configure first?

You have an Azure AD tenant that contains a user named User1 and a Microsoft 365 group named Group1. User1 is the owner of Group1.You need to ensure that User1 is notified every three months to validate the guest membership of Group1.What should you do?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have an Azure AD tenant.You need to ensure that only users from specific external domains can be invited as guests to the tenant.Which settings should you configure?

You have an Azure Active Directory (Azure AD) tenant that contains the following objects.-A device named Device1-Users named User1, User2, User3, User4, and User5Five groups named Group1, Group2, Group3, Group4, and Group5The groups are configured as shown in the following table.How many licenses are used if you assign the Microsoft 365 Enterprise E5 license to Group1?

You have an Azure Active Directory (Azure AD) tenant that contains the following objects:✑ A device named Device1✑ Users named User1, User2, User3, User4, and User5✑ Groups named Group1, Group2, Group3, Group4, and Group5The groups are configured as shown in the following table.To which groups can you assign a Microsoft Office 365 Enterprise E5 license directly?

You have a Microsoft Exchange organization that uses an SMTP address space of contoso.com. Several users use their contoso.com email address for self-service sign-up to 1 Microsoft Entra. You gain global administrator privileges to the Microsoft Entra tenant that contains the self-signed users. You need to prevent the users from creating user accounts in the contoso.com 2 Microsoft Entra tenant for self-service sign-up to Microsoft 365 services. Which PowerShell cmdlet should you run? According to the Microsoft SC-300 Study Guide and Microsoft Learn module: ''Manage Microsoft Entra domains and custom domain names'', when users perform self-service sign-up (email verified users) using a public domain such as contoso.com, Microsoft Entra creates a shadow tenant that you can later claim ownership of by verifying the DNS domain. Once you become the Global Administrator of the verified tenant, you can control domain behavior, including blocking self-service sign-up using that domain. To disable further self-service creation of accounts for that domain, you must modify the domain configuration using the Update-MgDomain PowerShell cmdlet. The cmdlet Update-MgDomain allows you to change properties of the domain, such as IsDefault, IsVerified, and crucially, blocking self-service sign-ups. Example: Update-MgDomain -DomainId contoso.com -IsAdminManaged $true This action prevents external or unverified users from using @contoso.com email addresses for new self-service sign-ups. Other options like Update-MgPolicyAuthorizationPolicy, Update-MgPolicyPermissionGrantPolicyExclude, and Update-MgDomainFederationConfiguration are used for tenant-wide access, permission grants, or federated authentication but not to block self-service domain registration.

You have an Azure AD tenant that contains the users shown in the following table.You need to compare the role permissions of each user. The solution must minimize administrative effort.What should you use?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to bulk invite Azure AD business-to-business (B2B) collaboration users.Which two parameters must you include when you create the bulk invite? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.