SC-300 Exam Alignment
SC-300

Implement and manage user identities: Create and configure user accounts, manage user properties including Usage location, distinguish Member from Guest users, perform bulk operations, and manage the deleted users recycle bin.

• Know the mandatory fields for creating a user account and which optional fields are required for certain functions (Usage location for licence assignment)
• Distinguish cloud-only users from hybrid synced users — synced attributes cannot be modified in Entra ID
• Know the difference between Member and Guest user types and their directory access rights
• Understand bulk user operations — bulk create, bulk invite, bulk delete — and the CSV template format
• Know that deleted users are soft-deleted for 30 days and can be restored within that window

Exam Tip: The Usage location field is a common exam topic. A user must have a Usage location set before a Microsoft 365 licence can be assigned to them. This is because some services are not available in all countries due to legal or compliance reasons. Without it, licence assignment will fail or be blocked.

👤 User Types in Microsoft Entra ID

Entra ID contains two primary user types with different origins and access rights:

🆕 Creating a User Account

Entra admin center › Identity › Users › All users › + New user

Microsoft Entra admin center
|
Identity › Users › New user

🏠 Home

👤 Identity

Users

Groups

Roles & admins

🛡️ Protection

Create new user — Required fields

User principal name *

jsmith@techcareers.in

Display name *

John Smith

Password *

Auto-generate ✓  |  Require change at next sign-in ✓

⚠ Important — Optional but required for licensing:
Usage location — must be set before a licence can be assigned

👥 Bulk User Operations

Bulk operations allow administrators to create, invite, or delete many users at once using a CSV file. The portal provides a downloadable template that must be filled out and uploaded.

Entra admin center › Identity › Users › All users › Bulk operations

🗑️ Deleted Users — 30-Day Recycle Bin

When a user is deleted in Entra ID, they are soft-deleted and moved to the Deleted users view (Identity → Users → Deleted users). The account is retained for 30 days before being permanently auto-deleted.

🔒 Account Sign-In State

An administrator can block a user's sign-in without deleting the account. This is useful for employees on leave, during offboarding review periods, or when investigating suspicious activity. A blocked user cannot sign in but the account remains in the directory with all its properties and group memberships intact.

Connect-MgGraph -Scopes 'User.ReadWrite.All'

# Create a new user with required properties
\$passwordProfile = @{
    Password = 'TempPass@2024!'
    ForceChangePasswordNextSignIn = \$true
}
New-MgUser -DisplayName 'John Smith' -UserPrincipalName 'jsmith@techcareers.in' -MailNickname 'jsmith' -AccountEnabled \$true -PasswordProfile \$passwordProfile -UsageLocation 'GB'

# Get a user and check their properties
Get-MgUser -UserId 'jsmith@techcareers.in' | Select-Object DisplayName,UserPrincipalName,UsageLocation,AccountEnabled

# Set Usage location (required before licence assignment)
Update-MgUser -UserId 'jsmith@techcareers.in' -UsageLocation 'GB'

# Block sign-in without deleting account
Update-MgUser -UserId 'jsmith@techcareers.in' -AccountEnabled \$false

# Soft-delete a user (30-day recycle bin)
Remove-MgUser -UserId 'jsmith@techcareers.in'

# List soft-deleted users in the recycle bin
Get-MgDirectoryDeletedItemAsUser | Select-Object DisplayName,UserPrincipalName,DeletedDateTime

# Restore a soft-deleted user within 30 days
Restore-MgDirectoryDeletedItem -DirectoryObjectId '<object-id-of-deleted-user>'

💡 Best Practices

• Always set the Usage location when creating a user — make it a standard step in your provisioning process. Licence assignment will fail without it, and fixing it after the fact wastes time in bulk provisioning scenarios
• Use block sign-in rather than immediate deletion during offboarding — preserve the account for 30+ days to allow access to mailbox data, OneDrive files, and audit investigation before permanently removing it
• For bulk user creation, always download the current CSV template from the portal rather than reusing an old one — Microsoft updates the template schema
• Store the bulk operation results file after each bulk create — it shows per-row success/failure and error messages, essential for troubleshooting partially completed operations
• Never modify attributes of synced users in Entra ID — changes will be overwritten by the next sync cycle from on-premises AD. Always make changes at the on-premises AD source

🎓 Interview Q&A