SC-300 Exam Alignment
SC-300

Implement authentication and access management: Configure the Authentication Methods Policy, implement MFA, configure SSPR with appropriate methods, set up password protection, and understand authentication strengths.

• Know each authentication method, its phishing resistance level, and licensing requirements
• Understand the Temporary Access Pass (TAP) — what it is, valid use cases, and configuration options
• Know how SSPR is enabled (None/Selected/All) and which methods require at least 1 vs 2 for reset
• Understand password protection — global banned passwords, custom banned passwords, and smart lockout thresholds
• Know the difference between per-user MFA (legacy) and Conditional Access MFA (current best practice)

Exam Tip: The SC-300 exam focuses heavily on phishing-resistant MFA. Know that FIDO2 security keys and Windows Hello for Business are phishing-resistant — they cannot be intercepted by adversary-in-the-middle attacks. Push notifications without number matching are vulnerable to MFA fatigue attacks. Microsoft recommends enabling number matching on Microsoft Authenticator to mitigate this.

🔐 Authentication Methods Policy

The Authentication Methods Policy (Protection → Authentication methods → Policies) is the modern, unified way to manage which authentication methods are available to users. It replaces the older per-user MFA settings for new deployments.

Entra admin center › Protection › Authentication methods › Policies

Microsoft Authenticator — Number Matching

Temporary Access Pass (TAP)

A TAP is a time-limited, passcode-based authentication method issued by an administrator. Its primary use cases are onboarding and recovery — not day-to-day authentication.

🔄 Combined Registration & SSPR

The combined security information registration experience (mysignins.microsoft.com) lets users register all their MFA methods and SSPR methods in a single workflow. This replaced the separate MFA and SSPR registration portals.

SSPR Configuration

Entra admin center › Protection › Password reset

🛡️ Password Protection

Entra ID Password Protection prevents users from choosing weak or predictable passwords — both in the cloud and, with the agent installed, on-premises AD.

Connect-MgGraph -Scopes 'Policy.ReadWrite.AuthenticationMethod','UserAuthenticationMethod.ReadWrite.All'

# Get the Authentication Methods Policy
Get-MgPolicyAuthenticationMethodPolicy | Select-Object Id,DisplayName

# List all auth methods and their enabled state
Get-MgPolicyAuthenticationMethodPolicy | Select-Object -ExpandProperty AuthenticationMethodConfigurations | Select-Object Id,State

# Create a Temporary Access Pass for a user (one-time use, 60 minute lifetime)
New-MgUserAuthenticationTemporaryAccessPassMethod -UserId 'user@domain.com' -IsUsableOnce:\$true -LifetimeInMinutes 60

# Get all registered auth methods for a user
Get-MgUserAuthenticationMethod -UserId 'user@domain.com'

💡 Best Practices

• Enable number matching on Microsoft Authenticator push notifications — it is enforced by Microsoft by default since 2023 and significantly reduces MFA fatigue attacks
• Prioritise FIDO2 security keys for highly privileged accounts (Global Admins, Security Admins) — they provide the strongest phishing-resistant authentication
• Use Temporary Access Passes for new employee onboarding instead of asking IT to set initial passwords — TAP is more secure, audited, and supports passwordless setup from day one
• Enable SSPR for all users — it significantly reduces help desk password reset tickets and improves user experience. Always require 2 methods for reset to prevent social engineering
• Add your company name, location abbreviations, and seasonal terms to the custom banned passwords list — these are the first passwords attackers try when they know your organisation
• Use Conditional Access MFA (Entra ID P1) rather than per-user MFA for new deployments — CA provides context-aware MFA enforcement (only require MFA from untrusted networks, for example) rather than always-on friction

🎓 Interview Q&A