SC-300 Exam Guide: Cost, Skills and 6-Week Study Plan

What SC-300 proves and who should take it

SC-300 earns you the Microsoft Certified: Identity and Access Administrator Associate credential. It shows you can design, implement and operate identity and access management with Microsoft Entra, following Zero Trust principles. Microsoft rates it Intermediate and tags it to the Security Engineer role (official exam page).

This exam fits you if you manage users, devices, apps or access in Azure and Microsoft 365. Microsoft says you should be familiar with Azure, Microsoft 365 services, Active Directory Domain Services (AD DS), PowerShell and Kusto Query Language (KQL).

If you want to move into architecture later, our SC-100 exam guide covers the next step up. If your work leans toward threat detection, read the SC-200 guide.

Skills measured and what each area really covers

The official study guide lists a version of the skills measured as of October 28, 2026. The English exam update was scheduled for that date, so use that version.

The study guide shows 25–30% for authentication in its summary list but 20–25% in that section's heading. Check the study guide for the final figure before you plan your hours.

The exam page still names the last area "Plan and implement identity governance." The newer study guide says "Plan and automate." Treat automation as fair game.

Key topics in the current skills list

• Tenant and users: built-in and custom Entra roles, administrative units, custom security attributes, bulk operations with the admin center and PowerShell, licenses.

• External and hybrid identity: cross-tenant access settings, cross-tenant synchronization, Microsoft Entra Connect Sync, Cloud Sync, password hash synchronization, pass-through authentication, and migration from AD FS.

• Authentication: certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, passkeys (FIDO2), SSPR, Windows Hello for Business, password protection.

• Conditional Access: policy planning, assignments, controls, session management, continuous access evaluation, authentication context, protected actions, templates.

• Risk and network access: ID Protection for user and sign-in risk, risky workload identities, Global Secure Access, Private Access and Internet Access.

Exam format at a glance

Microsoft offers an exam sandbox so you can try the question interface before test day. Use it once. It removes surprises about the layout.

If your language is not offered, the study guide says you can request an additional 30 minutes. Microsoft also offers accommodations if you use assistive devices or need extra time.

What it costs and how our voucher works

Microsoft publishes exam prices by country or region. In USD, the vendor list price is $165.00. Our voucher is $44.99.

Here are the terms in plain language:

• Validity: the voucher is valid for 12 months and redeemed with Pearson VUE.

• Delivery: the code is emailed within 12 hours of payment and also appears in your account.

• Before delivery: you can cancel for a full refund.

• After delivery: the code is non-refundable unless the test provider rejects it as invalid, already used or expired on first use.

• If that happens: contact support within 14 days with your order number and a screenshot. We replace or refund the code.

Full details are on our refund policy and delivery policy pages. You can buy the SC-300 voucher here.

A realistic six-week study plan

This plan assumes you already work a little with Azure or Microsoft 365. It totals about 41 hours. Add a week if you are new to hybrid identity.

Spend each session the same way. Read the study guide bullets first, then build the feature in a test tenant, then write down one failure you hit. The failure is what you will remember.

Microsoft recommends the new Practice Assessment on AI Skills Navigator because it matches the exam experience more closely. The legacy assessment at https://aka.ms/SC300-LearnPA is no longer updated.

Hands-on practice you can run this week

The study guide expects bulk operations in PowerShell and some KQL. Practice both in a test tenant.

Create and find users with Microsoft Graph PowerShell

Connect-MgGraph -Scopes "User.ReadWrite.All","Group.ReadWrite.All"
Get-MgUser -Filter "startsWith(displayName,'Test')"

Then import a CSV of ten fake users and add them to a group. Doing it once by hand teaches you what the bulk tools automate.

Read failed sign-ins with KQL

If you send Entra sign-in logs to a Log Analytics workspace, this query shows who fails most:

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != 0
| summarize Failures = count() by UserPrincipalName, AppDisplayName
| top 10 by Failures desc

Worked example: require MFA for administrators

1. Plan: decide the target (users with admin roles), the app scope and the control (require multifactor authentication).

2. Assign: target a pilot group first, and exclude one emergency access account.

3. Control: grant access only when MFA is satisfied.

4. Test: sign in as a pilot user and check the sign-in log to see which policy applied.

5. Troubleshoot: if access fails unexpectedly, read the Conditional Access tab on that log entry.

This five-step loop maps directly to the Conditional Access bullets in the study guide.

Common mistakes that cost points

• Reading only. Identity questions test which setting fixes a scenario. Click through the admin center until the menus feel familiar.

• Skipping hybrid topics. Entra Connect Sync, Cloud Sync, pass-through authentication and AD FS migration all appear in the skills list.

• Treating Conditional Access as one topic. It has ten bullets, from session management to authentication context. Study each.

• Using old material. Check any course against the October 28, 2026 skills. Passkeys (FIDO2), Global Secure Access and protected actions are named in the current list.

• Registering with a work account. Microsoft strongly recommends a personal Microsoft account. If you use a work or school account and leave, your exam records can be lost and are unrecoverable.

• Trusting "guaranteed pass" dumps. Practice material cannot replace hands-on work, and Microsoft's own assessment matches the exam experience more closely.

After you pass: keep the credential current

The credential expires unless you renew it. Microsoft's renewal frequency for this certification is 12 months. You renew at no cost by passing an online assessment on Microsoft Learn.

Connect your certification profile to your Microsoft Learn profile so you can schedule, renew and share your certificate. Set a calendar reminder a few weeks before the date.

Ready to schedule? Browse more security options in our Cybersecurity category.

Sources

• Microsoft Certified: Identity and Access Administrator Associate (official exam page)

• Study guide for Exam SC-300: Microsoft Identity and Access Administrator