🎯 Entra ID Course · Module 1 of 8
Microsoft Entra Admin Center Overview & Navigation
SC-300 Exam Alignment
SC-300
Implement and manage user identities: Understand the Microsoft Entra admin center interface, tenant properties, directory configuration, Entra ID edition capabilities, and how to connect administrative tools via Microsoft Graph PowerShell.
- Know the URL for the Microsoft Entra admin center and understand how it differs from the classic Azure portal
- Identify which Entra ID edition is required for key features — especially Conditional Access (P1) and PIM (P2)
- Know the left navigation structure: Identity, Protection, Governance, Workload identities, External Identities, Monitoring & health, Settings
- Understand that Microsoft Graph PowerShell has replaced the deprecated Azure AD PowerShell module
Exam Tip: SC-300 tests edition awareness heavily. Know that Conditional Access requires Entra ID P1 and Privileged Identity Management (PIM) requires Entra ID P2. The Free edition (included with all M365 plans) covers basic identity features. Also know: Azure AD PowerShell is deprecated — all scripts should use Microsoft Graph PowerShell.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It serves as the identity backbone for Microsoft 365, Azure, and thousands of third-party SaaS applications. The Microsoft Entra admin center — at entra.microsoft.com — is the unified management portal introduced in 2023, consolidating identity, access, and governance administration into one place.
🌐 Microsoft Entra Admin Center Interface
The Entra admin center replaced the older Azure AD blade in the Azure portal. It provides a cleaner, dedicated experience for identity administration. The URL is entra.microsoft.com.
entra.microsoft.com › Home
🏠 Home
👤 Identity
Overview
Users
Groups
External identities
Roles & admins
Devices
🛡️ Protection
Conditional Access
Authentication methods
Password reset
Identity Protection
🏛️ Governance
Access reviews
Entitlement management
Privileged Identity Mgmt
📊 Monitoring & health
Sign-in logs
Audit logs
⚙️ Settings
👥
Users
Manage identities
👥
Groups
Manage membership
🛡️
Cond. Access
Access policies
Tenant Overview
Tenant name: TechCareers
Tenant ID: xxxxxxxx-xxxx…
Primary domain: techcareers.in
Edition: Microsoft Entra ID P2
Key Navigation Sections
| Section | What You Find Here | Key Admin Tasks |
|---|---|---|
| Identity | Users, Groups, Devices, App registrations, Enterprise applications, Roles & admins, Administrative units | Create users, manage groups, assign roles, register apps |
| Protection | Conditional Access, Authentication methods, Password reset (SSPR), Identity Protection, Risky users & sign-ins | Build CA policies, configure MFA methods, enable SSPR, review risky sign-ins |
| Governance | Access reviews, Entitlement management, Privileged Identity Management (PIM), Terms of use, Lifecycle workflows | Create access reviews, manage JIT role activation, configure entitlement packages |
| Workload identities | Service principals, App registrations credentials and permissions, Workload identity federation | Manage app credentials, review app permissions, configure federation |
| External Identities | B2B collaboration, Cross-tenant access settings, External collaboration settings, User flows | Configure guest access, set up cross-tenant access policies |
| Monitoring & health | Sign-in logs, Audit logs, Provisioning logs, Workbooks, Diagnostic settings, Identity Secure Score | Diagnose sign-in failures, export logs, review security score |
| Settings | Tenant properties, User settings, Group settings, External user settings | Configure tenant-wide defaults for user and group management |
📋 Entra ID Editions & Licensing
Microsoft Entra ID is available in four editions. Understanding which edition unlocks which features is critical for the SC-300 exam and for real-world planning.
| Feature | Free | P1 | P2 | Governance |
|---|---|---|---|---|
| Included with | All M365 / Office 365 plans | M365 Business Premium, E3, EMS E3 | M365 E5, EMS E5 | Standalone add-on |
| User & group management | ✅ | ✅ | ✅ | ✅ |
| MFA (per-user and Security Defaults) | ✅ | ✅ | ✅ | ✅ |
| Conditional Access | ❌ | ✅ | ✅ | ✅ |
| SSPR (Self-Service Password Reset) | ❌ | ✅ | ✅ | ✅ |
| Dynamic group membership | ❌ | ✅ | ✅ | ✅ |
| Group-based licensing | ❌ | ✅ | ✅ | ✅ |
| Administrative Units | ❌ | ✅ | ✅ | ✅ |
| Custom roles | ❌ | ✅ | ✅ | ✅ |
| Privileged Identity Management (PIM) | ❌ | ❌ | ✅ | ✅ |
| Identity Protection (risk policies) | ❌ | ❌ | ✅ | ✅ |
| Access Reviews | ❌ | ❌ | ✅ | ✅ |
| Entitlement Management | ❌ | ❌ | ❌ | ✅ |
| Lifecycle Workflows | ❌ | ❌ | ❌ | ✅ |
⚠️ Licence Assignment Requirement
For P1 and P2 features to work for a user, that user must be assigned an Entra ID P1 or P2 licence. If a Conditional Access policy targets a user who doesn't have a P1 licence, the policy may not be enforced correctly for that user. Licence assignment can be done directly to users or via group-based licensing (P1 feature itself).
🔧 Tenant Properties & Overview
The tenant overview (Identity → Overview) shows essential information about your Entra directory:
| Property | Description | Where Used |
|---|---|---|
| Tenant ID | A globally unique identifier (GUID) for your directory | Required for API calls, Graph PowerShell connections, cross-tenant federation |
| Primary domain | The initial domain created when the tenant was set up (e.g., contoso.onmicrosoft.com) | Default UPN suffix for new users |
| Custom domains | Verified custom domains added and verified via DNS (e.g., contoso.com) | Used as UPN suffix, email domain |
| Directory ID | Same as Tenant ID — used interchangeably | Azure resource management, ARM templates |
| Edition | Shows which Entra ID licence is active | Determines which features are available |
💻 Microsoft Graph PowerShell
The Microsoft Graph PowerShell SDK is the official, supported PowerShell module for managing Entra ID. The older Azure AD PowerShell (AzureAD module) and MSOnline modules are deprecated as of March 2024 and will be removed — all scripts must be migrated to Microsoft Graph PowerShell.
PowerShell — Microsoft Graph Setup & Connection
# Install the Microsoft Graph PowerShell SDK Install-Module Microsoft.Graph -Scope CurrentUser # Connect to Microsoft Graph (specify scopes needed) Connect-MgGraph -Scopes 'User.ReadWrite.All','Group.ReadWrite.All','Directory.ReadWrite.All' # Check the connected tenant and current permissions Get-MgContext # Get tenant overview information Get-MgOrganization | Select-Object DisplayName,Id,TenantType,VerifiedDomains # List all verified domains on the tenant (Get-MgOrganization).VerifiedDomains | Select-Object Name,IsDefault,IsInitial,Type # Disconnect when done Disconnect-MgGraph
💡 Azure AD PowerShell vs Microsoft Graph PowerShell
- AzureAD module (Connect-AzureAD, Get-AzureADUser): Deprecated March 2024, being removed
- MSOnline module (Connect-MsolService): Also deprecated, older module
- Microsoft.Graph module (Connect-MgGraph, Get-MgUser): Current, supported, recommended
- Microsoft Graph PowerShell uses permission scopes — you specify exactly what permissions you need. This aligns with least-privilege access and is audited in sign-in logs as service principal activity
💡 Best Practices
- Bookmark entra.microsoft.com as the primary identity admin portal — avoid using the Azure portal Azure AD blade which is being phased out
- Verify your Entra ID edition before planning identity features — many key security features (Conditional Access, PIM, Identity Protection) require P1 or P2 licences
- Migrate all Azure AD PowerShell scripts to Microsoft Graph PowerShell now — the deprecated modules will be removed and scripts will break without warning
- Use the least-privilege scopes when connecting via Graph PowerShell — only request the permissions your script needs, not Directory.ReadWrite.All for a read-only task
- Create a dedicated break-glass Global Administrator account that is excluded from all Conditional Access policies — this ensures you can always recover access in an emergency
🎓 Interview Q&A
Q: What is Microsoft Entra ID and how does it differ from on-premises Active Directory?
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. It is designed for internet-scale cloud authentication using modern protocols like OAuth 2.0 and OIDC. On-premises Active Directory Domain Services (AD DS) uses Kerberos and LDAP and is designed for managing resources within a corporate network boundary. Entra ID is flat — it has no OUs or Group Policy Objects (GPOs). It manages access to cloud apps (Microsoft 365, SaaS apps, Azure) rather than domain-joined computers and file shares. The two can coexist and sync via Microsoft Entra Connect.
Q: Which Entra ID licence is required for Conditional Access policies?
Conditional Access requires Microsoft Entra ID P1 (or higher). It is included in Microsoft 365 Business Premium, Microsoft 365 E3, and EMS E3. The Entra ID Free tier included with basic M365 plans does not include Conditional Access. Microsoft 365 E5 and EMS E5 include Entra ID P2, which additionally enables risk-based Conditional Access policies (Sign-in risk, User risk) through Identity Protection.
Q: Your organisation is upgrading from Azure AD PowerShell scripts. What module should you migrate to and why?
Migrate to the Microsoft Graph PowerShell SDK (Microsoft.Graph module). The Azure AD PowerShell module (AzureAD) and the MSOnline module were deprecated in March 2024 and will be removed, which will break any scripts still using them. Microsoft Graph PowerShell uses the same underlying Microsoft Graph REST API as the Entra admin center, provides full feature parity (and more), supports permission scopes for least-privilege access, and is the only module that will receive ongoing feature updates from Microsoft.
🎯 SC-300 Mock Test
Module 1 — Entra Admin Center Overview
5 questions · Scenario-based · Pass mark: 70%
Question 1 of 5
Your organisation wants to implement Conditional Access policies requiring MFA for all users. A colleague says the Entra ID Free licences included with their Microsoft 365 Business Essentials subscription are sufficient. Is this correct?
AYes — MFA is available on all Entra ID editions including Free
BYes — Security Defaults on the Free tier can enforce MFA without Conditional Access
CNo — Conditional Access requires Entra ID P1 or higher; the Free tier does not support CA policies
DNo — Conditional Access requires Entra ID P2 for all use cases
Question 2 of 5
An administrator needs to configure Privileged Identity Management (PIM) to enable just-in-time activation of the Global Administrator role. Which Entra ID edition is required?
AEntra ID Free
BEntra ID P2
CEntra ID P1
DMicrosoft Entra Governance
Question 3 of 5
A team is migrating existing Azure AD PowerShell scripts to a supported module. They currently use Connect-AzureAD and Get-AzureADUser. What is the correct replacement?
AConnect-MsolService and Get-MsolUser (MSOnline module)
BConnect-AzAccount and Get-AzADUser (Az module)
CConnect-MgGraph and Get-MgUser (Microsoft.Graph module)
DConnect-EntraID and Get-EntraUser (Entra module)
Question 4 of 5
Where in the Microsoft Entra admin center would you find Conditional Access policies?
AProtection → Conditional Access
BIdentity → Security → Conditional Access
CGovernance → Conditional Access
DSettings → Security policies → Conditional Access
Question 5 of 5
An administrator wants to run a Microsoft Graph PowerShell script that reads user sign-in logs. They run Connect-MgGraph with no scopes specified. What happens?
AThe connection succeeds with full Global Admin permissions automatically
BThe connection fails — scopes are required
CThe connection succeeds with read-only permissions for all resources
DThe connection succeeds with a default minimal scope — the script will fail when trying to read sign-in logs without the AuditLog.Read.All scope
🔒
This module is locked — Complete the previous module and pass its mock test to unlock this one.
Complete the quiz above (70%+) to unlock Module 2: User Identity Management