Chapter 2 of 4 · Microsoft SC-300

Implement Authentication and Access Management

Methods, MFA and SSPR, Conditional Access, ID Protection risk policies and Global Secure Access.

  • 6topics
  • 32 minfast track
  • 1diagrams and exhibits
  • 25–30%of the exam
Start with Authentication Methods, MFA and SSPR

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Authentication Methods, MFA and SSPRSC-300 authentication: the methods policy, Authenticator, passkeys, certificate based authentication, Temporary Access Pass…6 min
  2. 2Password Protection, Windows Hello and Hybrid AuthenticationSC-300 password protection: banned lists, smart lockout defaults, Windows Hello for Business trust models, Entra Kerberos and…5 min
  3. 3Conditional Access PoliciesSC-300 Conditional Access: assignments, conditions, grant controls, templates, report only mode, exclusions, evaluation order and…Diagram6 min
  4. 4Conditional Access Session Controls and Protected ActionsSC-300 session controls: sign in frequency, continuous access evaluation, token protection, authentication context, app enforced…5 min
  5. 5Identity Protection and RiskSC-300 ID Protection: user and sign in risk, risk policies, self remediation with SSPR and writeback, risky workload identities…5 min
  6. 6Global Secure AccessSC-300 Global Secure Access: Private Access and Internet Access, the client, connectors, traffic profiles, Quick Access, web…5 min

About this chapter

What this chapter covers

This is the largest domain of the exam, at 25 to 30 percent. It covers how users prove who they are, how access decisions are made, how risk is detected and handled, and how network access is secured with Global Secure Access.

Questions are detailed scenarios, such as a policy that does not apply to the right users or a sign in that is blocked, and ask which setting to change.

How the topics fit together

The pages follow a sign in from start to finish.

Prove identitymethods, MFA, passwordsDecideConditional Access policiesControl the sessionfrequency, CAE, protected actionsHandle riskID ProtectionSecure the networkGlobal Secure Access
  • Authentication methods, MFA and SSPR covers the methods, Temporary Access Pass, passkeys, tenant wide settings and password reset.
  • Password protection, Windows Hello and hybrid authentication covers banned passwords, smart lockout, Windows Hello for Business, revoking sessions and Kerberos.
  • Conditional Access policies covers assignments, conditions, grant controls, templates and troubleshooting.
  • Conditional Access session controls and protected actions covers sign in frequency, continuous access evaluation, authentication context and protected actions.
  • Identity Protection and risk covers risk detections, risk policies and remediation.
  • Global Secure Access covers Private Access, Internet Access, the client and traffic profiles.
Exam tip

For any policy question, check four things in order: who is included and excluded, which apps, which conditions, and which control. Most wrong answers come from one of these.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with examples and tables.
  • What to remember for the exam: the facts to memorise and how questions are phrased.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Ready for more practice?

The full Microsoft SC-300 question bank has 650 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.