Skip to content
CertGPS

Microsoft Identity and Access Administrator Associate

Proves you can run Microsoft Entra end to end: hybrid sync, Conditional Access, app integration, Privileged Identity Management and access reviews

IntermediateMicrosoft

The exam

Exam cost
$165
Study time
2-4 months
Passing score
700 (scale of 1–1,000)
Valid for
1 year

Before you book

  • None required
  • Recommended: familiarity with Azure, Microsoft 365 services and Active Directory Domain Services
  • Recommended: familiarity with PowerShell and Kusto Query Language (KQL)

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. Microsoft Identity and Access Administrator Associate

    You are here

  2. Microsoft Cloud and AI Security Engineer Associate

    Intermediate

    Next step. Extends identity work into Azure network, data and compute security through SC-500

Study guide

Last updated

SC-300 Study Guide: Microsoft Entra Identity Administration, Exam and Lab Plan

SC-300 earns the Microsoft Certified: Identity and Access Administrator Associate, and it's an exam about Microsoft Entra from end to end: hybrid sync, authentication methods, Conditional Access, app integration and identity governance. The English version is updated on October 28, 2026, with minor changes to user authentication, Global Secure Access and privileged access. The bigger planning issue is licensing. Much of the outline needs Entra ID P2 to practise.

Who it suits, and who should choose something else

It fits identity administrators, Microsoft 365 administrators who've inherited sign-in and access policy, and engineers moving an organization off Active Directory Federation Services (AD FS) or on-premises Active Directory. Microsoft expects familiarity with Azure, Microsoft 365 services, Active Directory Domain Services, PowerShell and Kusto Query Language (KQL). It suits someone a year or two into identity work who already runs a tenant day to day.

If your organization's workforce identity runs on Okta, Okta Certified Professional proves more relevant skills. If identity is only one part of your Azure security job, SC-500 covers it alongside network, data and compute. If you sit on the detection side, SC-200 is the Microsoft exam for analysts.

The exam at a glance

SC-300
CertificationMicrosoft Certified: Identity and Access Administrator Associate
Next updateEnglish version updated October 28, 2026
Time100 minutes; Microsoft says the exam may include interactive components
QuestionsNot published for this exam
Passing score700 on a 1–1,000 scale
Price$165 in the United States; varies by country
DeliveryProctored, scheduled through Pearson VUE
PrerequisitesNone
ValidityOne year; renew free with an online assessment

What the four skill areas cover

  • Implement and manage user identities: 20–25%
  • Implement authentication and access management: 25–30% in Microsoft's summary, 20–25% in its detailed outline
  • Plan and implement workload identities: 20–25%
  • Plan and automate identity governance: 20–25%

Microsoft's study guide gives two different weights for the authentication area. Treat it as the largest, since it's also the longest list. It runs from authentication methods (certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, passkeys, Windows Hello for Business, Entra Kerberos for hybrid identities) through Conditional Access in detail: assignments and controls, troubleshooting, session management, continuous access evaluation, authentication context, protected actions and templates. It then covers Entra ID Protection for user, sign-in and workload identity risk, and Global Secure Access, meaning Entra Private Access, Entra Internet Access and the Microsoft 365 traffic profile.

User identities cover the tenant itself: built-in and custom roles, administrative units, domains, custom security attributes, external collaboration and cross-tenant synchronization. Hybrid identity is a heavy part of it, with Entra Connect Sync and Cloud Sync, password hash synchronization, pass-through authentication, migration away from AD FS and Connect Health.

Workload identities take in more than the name suggests. Besides managed identities and service principals, the area covers enterprise app settings and consent, Application Proxy for on-premises apps, app registrations with API permissions and app roles, and a block on Microsoft Defender for Cloud Apps: cloud discovery, Conditional Access app control, session policies and OAuth app policies.

Governance covers entitlement management (catalogs, access packages, terms of use, connected organizations), access reviews, Privileged Identity Management for Entra roles, Azure resources and groups, emergency access accounts, and monitoring through sign-in and audit logs, workbooks, KQL in Log Analytics and Identity Secure Score.

A plan built around a test tenant

You need a tenant you can break. Use a test Microsoft Entra tenant that isn't your employer's production directory, and start the free 30-day Entra ID P1 or P2 trial when you're ready to work on the P2 features, since Privileged Identity Management needs P2 or Entra ID Governance licences. Thirty days is short, so do the free-tier work first:

  1. Before the trial: users, groups, administrative units, custom roles, bulk operations in PowerShell, guest invitations and app registrations with API permissions.
  2. Trial weeks one and two: Conditional Access. Build policies from templates, break sign-in on purpose with a bad device or location condition, and fix it with the What If tool and sign-in logs.
  3. Trial weeks three and four: Identity Protection risk policies, PIM role activation with approval, an access package with an access review, and a KQL query over sign-in logs sent to Log Analytics.

Hybrid sync needs a domain controller. A small Windows Server virtual machine running Entra Connect Sync or Cloud Sync is enough to see password hash sync and pass-through authentication from both ends.

Microsoft's free practice assessment and exam sandbox show the format, and there's a four-day instructor-led course, SC-300T00-A. We'd split your time roughly evenly across the four areas, with extra on Conditional Access. It touches every other area, and the exam's troubleshooting items tend to involve it.

After you pass

The certification lasts a year. Renewal is free: an unproctored, open-book assessment on Microsoft Learn during the six months before expiry, which you can retake as often as you need. A failed exam can be retaken after 24 hours, then after 14-day waits, up to five attempts in 12 months.

From here:

  • SC-500 to extend from identity into Azure network, data and compute security.
  • Okta Certified Professional if you support a mixed Okta and Entra estate.
  • Microsoft's Cybersecurity Architect Expert, via SC-100, which accepts SC-300 as its prerequisite.

Our view

SC-300 is a well-built exam for a real job. Its skills list matches what an Entra administrator does, and free renewal keeps you on current features. The weaknesses are Microsoft's. Feature names and licence tiers change often, and the licensing wall means many candidates study P2 features from documentation alone. It's worth $165 if Entra is the identity system you run. If you want to show identity expertise beyond one vendor, pair it with something broader.

Sources