Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
The Microsoft Certified: Identity and Access Administrator Associate is Microsoft's role-based certification for the people who run Microsoft Entra ID. This October 2026 guide covers the SC-300 exam on the outline that takes effect October 28, 2026, the four domains and their weights, the 100-minute exam and passing score, the $165 fee, the free yearly renewal, DoD 8140 status, and the roles it supports.
The Microsoft Certified: Identity and Access Administrator Associate, earned through exam SC-300, is Microsoft's role-based certification for the people who run identity in Microsoft Entra. It sits at the associate tier, one step above SC-900, and it is the Microsoft exam built around identity and access.
Microsoft describes the job as designing, implementing, and operating an organization's identity and access management with Microsoft Entra. In practice that means managing identities through their whole lifecycle for users, devices, Azure resources, and applications, applying Zero Trust principles, and troubleshooting, monitoring, and reporting on sign-in and access. The exam follows that scope closely, from tenant roles and hybrid sync to Conditional Access, app registrations, access reviews, and Privileged Identity Management.
SC-300 has no prerequisites, though Microsoft expects familiarity with Azure, Microsoft 365, Active Directory Domain Services, PowerShell, and KQL. Like other Microsoft role-based certifications, it is valid for 12 months and renews free online. It is issued and maintained by Microsoft. The English exam updates on October 28, 2026, and this page describes that outline: the same four domains and weights, with minor changes to the user authentication, Global Secure Access, and privileged access skill groups.
Tenant roles, administrative units, users and groups, external users, cross-tenant access, and hybrid sync. 20 to 25%.
Authentication methods, MFA, self-service password reset, Conditional Access, ID Protection, and Global Secure Access. The largest domain at 25 to 30%.
Managed identities, enterprise apps, app registrations, and Microsoft Defender for Cloud Apps. 20 to 25%.
Entitlement management, access reviews, PIM, emergency access accounts, and monitoring with logs, workbooks, and KQL. 20 to 25%.
Four things that make the Identity and Access Administrator Associate the credential for people who own sign-in and access in a Microsoft tenant.
Microsoft 365 and Azure both sign people in through Microsoft Entra ID, so whoever runs Entra decides who gets into email, files, apps, and cloud resources. SC-300 covers that service end to end, from tenant roles and hybrid sync to Conditional Access, app integration, and privileged access, which is why it maps so closely to what an identity team actually does.
Where SC-900 asks what a Conditional Access policy is for, SC-300 hands you a requirement and expects the right assignments and controls, plus the fix when a policy blocks the wrong user. The exam is proctored, runs 100 minutes, and may include interactive components. You can open Microsoft Learn during the exam, but the clock keeps running while you read.
Microsoft awards the Cybersecurity Architect Expert only to people who also hold one of three associate certifications, and SC-300 is one of them (SC-200 and SC-500 are the others). Our SC-100 exam guide explains why identity is often the strongest of the three starting points.
SC-300 is not a DoD 8140 credential. Microsoft claims no 8140 mapping for it, so it will not satisfy a cyber-coded position on its own. The current matrix is published at the DoD Cyber Exchange.
Its weight comes from the market instead. Any organization that signs its people in through Microsoft Entra ID needs someone who can configure it safely, and SC-300 is Microsoft's credential for that job.
The certification and the SC-300 exam as Microsoft publishes them for the October 28, 2026 outline.
SC-300 is a working credential in its own right, and for many people it is also a step. From here most people move up to the expert architect exam, add the security operations side, or pick up a vendor-neutral senior credential.
The expert step on the Microsoft security track. SC-100 tests design rather than configuration, across security operations, identity, compliance, infrastructure, applications, and data. Microsoft awards the expert credential only if you also hold SC-300, SC-200, or SC-500, so SC-300 counts toward it directly. See our SC-100 exam guide.
The detection and response counterpart. SC-200 covers Microsoft Defender XDR, Microsoft Sentinel, and KQL threat hunting across three domains, including the investigation of compromised identities that Entra ID flags. Identity admins who want to see what happens after a sign-in goes wrong often take it next.
The vendor-neutral senior move. Identity and Access Management is one of the eight CISSP domains, and CISSP sits on the DoD 8140 matrix at the Advanced level. It requires five years of paid experience in two or more domains, so for most SC-300 holders it comes later. See our CISSP guide.
SC-300 sits at the associate tier of Microsoft's security path. SC-900 is a helpful but optional foundation, and from SC-300 the path leads up to the Cybersecurity Architect Expert or across to other security and Azure credentials.
The security vocabulary
Run identity and access
Pick your path
Two questions to answer before you commit: can you sit it, and should you pursue SC-300 specifically. Here's a straight answer to both.
No prerequisite certification and no required experience.
SC-300 has no prerequisites. You schedule through Pearson VUE, pay the $165 US fee, and sit a 100-minute proctored exam at a test center or online. Microsoft recommends registering with a personal Microsoft account rather than a work or school one, because exam records tied to an organizational account are lost if you leave that organization.
Associate level, written for working admins.
Microsoft expects familiarity with Azure, Microsoft 365, AD DS, PowerShell, and KQL, and the questions assume you have configured these settings, not just read about them. Microsoft Learn is open to you during the exam, but the clock keeps running, so it helps with a quick lookup rather than a whole topic. Build policies in a test tenant, work the Microsoft Learn path, and take Microsoft's free SC-300 practice assessment to find the gaps.
SC-300 is a credential for people who already do identity work, or are about to. These are the roles where its objectives match the daily job.
The job the exam is named for. Owns users, groups, authentication methods, and Conditional Access in Microsoft Entra ID, and answers for who can sign in to what. SC-300 tests the same tasks this role handles week to week.
Connects SaaS and on-premises apps to Entra ID, sets up app registrations and API permissions, and decides when a workload should use a managed identity or a service principal. The workload identities domain is written for this work.
Runs the tenant and, more and more often, its sign-in security too. Many Microsoft 365 admins take SC-300 once MFA rollout, guest access, and Conditional Access land on their desk.
Runs access reviews, builds access packages for new hires and role changes, and keeps privileged roles in PIM so they are activated only when needed. Audit and compliance teams depend on this role, and the governance domain maps to it directly.
Microsoft files SC-300 under its Security Engineer role. Engineers who protect Azure and Microsoft 365 treat identity as the first line of control, and many pair SC-300 with SC-500 for the infrastructure side.
Keeps on-premises Active Directory and Entra ID in step with Entra Connect Sync or Cloud Sync, and plans the move off AD FS. The hybrid identity objectives in domain 1 come straight from this job.
SC-300 is most often weighed against the fundamentals exam before it, the Azure administrator exam beside it, and the security operations exam it pairs with. Here is how the four line up.
| SC-300 | Security, Compliance, and Identity Fundamentals (SC-900) | Azure Administrator (AZ-104) | Security Operations Analyst (SC-200) | |
|---|---|---|---|---|
| Issuer | Microsoft | Microsoft | Microsoft | Microsoft |
| Level | Associate | Fundamentals | Associate | Associate |
| Focus | Identity and access in Microsoft Entra | Microsoft security, compliance, and identity concepts | Operating Azure environments | Detection, response, and threat hunting |
| Domains | 4 | 4 | 5 | 3 |
| Prerequisites | None | None | None (6 months recommended) | None |
| Exam | 100 min, count not published | 45 min, count not published | 40 to 60 items, 100 min | 100 min, count not published |
| Passing Score | 700 of 1000 | 700 of 1000 | 700 of 1000 | 700 of 1000 |
| Cost (US) | $165 | $99 | $165 | $165 |
| Validity | 1 year, free renewal | Does not expire | 1 year, free renewal | 1 year, free renewal |
| DoD 8140 | No mapping claimed | Not listed | Not listed | No mapping claimed |
| Best For | Admins who own Entra ID, sign-in, and access | First security credential in a Microsoft shop | Cloud administrators | SOC analysts working in Defender XDR and Sentinel |
Pricing varies by region and taxes. Microsoft claims no DoD 8140 mapping for SC-300 or SC-200, and their recognition is market-driven. SC-900 facts are from our SC-900 guide and AZ-104 facts are from our Azure Administrator guide. SC-200 facts are from its Microsoft Learn certification page and study guide (outline as of October 21, 2026).
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our four-day Identity and Access Administrator boot camp covers all four SC-300 domains with Official Microsoft Courseware, hands-on labs every day, and an instructor who works in the field. Your $165 exam voucher and a free retake are included, and you can attend live online or in person.
Where SC-300 leads, why identity sits at the center of Zero Trust, and what to know before exam day.
SC-300 is one of the three associate certifications that count toward the Cybersecurity Architect Expert. This guide covers the SC-100 domains, the October 2026 update, and why identity is often the strongest of the three starting points.
The Microsoft exams people are actually sitting this year, what each one costs, and where SC-300 fits next to SC-200 and SC-500 in the security group.
Zero Trust starts with identity. This piece explains the model in plain terms and why SC-300 goes deeper than most certifications into identity-based controls like Conditional Access and Privileged Identity Management.
What changed when Microsoft retired the Azure Security Engineer exam and what the Cloud and AI Security Engineer credential covers, including its identity, access, and governance domain.
The full Microsoft map from fundamentals through associate and expert, including the security analyst and architect paths where SC-300 pairs with SC-200 and leads to SC-100.
A security services company was breached through admin accounts that had no MFA. A plain case for the authentication and privileged access controls that SC-300 covers.
What happens at check-in, what ends a session early, and how Microsoft's retake waits compare with other vendors. Worth reading before you book an online proctored SC-300 slot.
The SC-300 exam is organized into four domains. Authentication and access management is the heaviest at 25 to 30 percent, and the other three carry 20 to 25 percent each. Click any domain for what it covers.
Setting up and running the Microsoft Entra tenant: built-in and custom Entra roles, administrative units, effective permissions, domains, company branding, and tenant, user, group, and device settings. It covers creating users and groups, custom security attributes, bulk operations in the Entra admin center and PowerShell, device join and registration, and licenses. External users and tenants are here too (external collaboration settings, bulk guest invitations, cross-tenant access settings, cross-tenant synchronization, and SAML and WS-Fed identity providers), along with hybrid identity through Entra Connect Sync, Cloud Sync, password hash synchronization, pass-through authentication, single sign-on for domain-joined devices, AD FS migration, and Connect Health.
The heaviest domain. Authentication methods such as certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, and passkeys (FIDO2), tenant-wide MFA settings, self-service password reset, Windows Hello for Business, password protection, revoking sessions, and Entra Kerberos for hybrid identities. Conditional Access takes up a large share: planning, assignments, controls, testing and troubleshooting, session management, device-enforced restrictions, continuous access evaluation, authentication context, protected actions, and templates. It closes with user and sign-in risk in Microsoft Entra ID Protection, MFA registration campaigns, risky workload identities, and Global Secure Access with Entra Private Access, Entra Internet Access, and the Microsoft 365 traffic profile.
Choosing the right identity for an application or Azure workload (managed identities, service principals, user accounts, or managed service accounts), then creating managed identities and using them to reach other Azure resources. It covers enterprise application settings, the Entra roles that manage apps, Application Proxy for on-premises apps, SaaS integration, app roles and assignments, user and admin consent, and application collections. App registrations, app authentication, and API permissions follow, and the domain ends with Microsoft Defender for Cloud Apps: cloud discovery, connected apps, Conditional Access app control, access and session policies, OAuth app policies, and the cloud app catalog.
Entitlement management in Microsoft Entra, with catalogs, access packages, access requests, terms of use, the lifecycle of external users, and connected organizations. It covers planning, running, and responding to access reviews, then privileged access through Privileged Identity Management for Entra roles, Azure resources, and groups, including the request and approval process, audit history, and emergency access accounts. The domain finishes with monitoring: sign-in, audit, and provisioning logs, diagnostic settings that send data to Log Analytics, storage accounts, or Event Hubs, KQL queries, workbooks, and Identity Secure Score.
Domains and weights reflect the Microsoft SC-300 skills-measured outline that takes effect October 28, 2026 for the English exam. The update keeps the same four domains and weights and makes minor changes to the user authentication, Global Secure Access, and privileged access skill groups. One heading inside the study guide shows 20 to 25 percent for authentication and access management, but the guide's skills-at-a-glance summary lists 25 to 30 percent and its change log shows no change to that domain. Microsoft refreshes exams periodically, so confirm the current outline on Microsoft Learn before scheduling.
The questions candidates ask most often when researching the Microsoft Identity and Access Administrator Associate certification.
The Microsoft Certified: Identity and Access Administrator Associate, earned by passing exam SC-300, is Microsoft's role-based certification for the people who design, implement, and operate identity and access in Microsoft Entra. It covers user and hybrid identities, authentication and Conditional Access, workload identities and enterprise apps, and identity governance. It's an associate-level exam, so the questions put you in a scenario and expect you to configure or troubleshoot the service.
Microsoft updates the English version of SC-300 on October 28, 2026. The four domains and their weights stay the same. Microsoft's change log rates the changes as minor and lists three skill groups: Microsoft Entra user authentication, Global Secure Access, and privileged access. Localized versions usually follow about eight weeks later. This page describes the October 28, 2026 outline.
No. SC-300 has no required certification or experience, so anyone can register. Microsoft does say candidates should be familiar with Azure, Microsoft 365 services and workloads, and Active Directory Domain Services, plus PowerShell and Kusto Query Language (KQL). Treat that list as a real expectation, because the exam is written for people who already work in Entra ID.
The four domains are Implement and manage user identities (20 to 25 percent), Implement authentication and access management (25 to 30 percent), Plan and implement workload identities (20 to 25 percent), and Plan and automate identity governance (20 to 25 percent). Authentication and access management, which includes Conditional Access and ID Protection, carries the most weight.
Microsoft doesn't publish an exact question count for SC-300. Its general guidance is that most certification exams have between 40 and 60 questions. You get 100 minutes, and Microsoft's exam duration table pairs a 100-minute role-based exam with 120 minutes of seat time. The exam may include interactive components, and the exam sandbox on Microsoft Learn shows the question types in the interface you will use.
You need 700 on a scale of 1 to 1,000. Microsoft uses scaled scoring, so 700 doesn't mean 70 percent of the questions. There's no penalty for guessing, multi-part questions can award partial credit, and a few unscored questions may appear, so answer every question.
The SC-300 exam costs $165 USD in the United States as of October 2026, with prices that vary by country and local taxes. You schedule it through Pearson VUE and take it at a test center or online with a remote proctor. Training Camp's Identity and Access Administrator boot camp includes the exam voucher in the program fee, along with a free retake.
No DoD 8140 mapping is claimed for it. Microsoft doesn't list SC-300 against a DoD 8140 work role, so don't count on it to satisfy a cyber-coded position requirement on its own. Its value is practical instead, because every organization that signs people in through Microsoft Entra ID needs someone who can configure it. If you need an 8140-approved credential, CompTIA Security+ and CISSP are both on the matrix. See the full DoD 8140 work role paths.
Yes. Like other Microsoft role-based certifications, it's valid for 12 months. Renewal is free. You pass a short, unproctored, open-book assessment on Microsoft Learn during the six months before your expiration date, and the certification is extended one year from that date. You can retake the renewal assessment as often as you need, as long as you pass before the certification expires.
SC-300 lines up with identity and access administrator, IAM engineer, and identity governance roles, and with Microsoft 365 and Azure administrators whose job now includes Entra ID, MFA, and Conditional Access. It also supports cloud security engineers and the systems administrators who keep on-premises Active Directory in sync with Entra ID. Employers read it as proof you can configure sign-in, access, and privileged roles in a Microsoft tenant.
Pick the one that matches where your day goes. SC-300 covers who can sign in and what they can reach, through Entra ID, authentication, Conditional Access, app access, and governance. SC-200 picks up after something has gone wrong, with incident response and threat hunting in Microsoft Defender XDR and Microsoft Sentinel. Both are 100-minute associate exams with a $165 US fee and a free yearly renewal, and either one counts toward SC-100. Many security teams end up holding both.
It's a real step up from SC-900. The questions are scenarios, and the wrong answers usually describe a setting that exists but doesn't meet the requirement. Expect the hardest questions in Conditional Access and identity governance, where the exam tests policy design rather than where a menu lives. Plan on hands-on time in a test tenant, work through the Microsoft Learn path, and take the free practice assessment on Microsoft Learn before you book.
For anyone who already works in Microsoft Entra ID or is moving into identity work, yes. It costs $165, renews free each year, counts toward the Cybersecurity Architect Expert, and covers the sign-in, Conditional Access, and privileged access controls that Zero Trust programs depend on. It's a weaker fit if your organization runs identity on another platform, if you need a DoD 8140 credential, or if your job is mostly incident response, where SC-200 fits better.
If you're weighing the certification, planning the Microsoft security path, or arranging identity training for a team, tell us where you are and we'll help you map out the right path.