ITForMe Beta Sign in
SC-300 SC-300 Skills measured April 27, 2026 Plan and implement workload identities Runs in your browser · no setup Original practice · Review pending

Repair an application identity and consent design

Replace a stored application credential with verified, least-privilege workload access.

Estimated15 min
DifficultyIntermediate
Points10
Scenario brief

An Azure-hosted inventory job reads a protected API without a signed-in user. Repair the fictional identity path without interrupting the scheduled job or leaving a reusable application secret behind.

Content record

Original practice · Review pending

Mapped to Microsoft SC-300 objectives · Internal validation 2026-09-15 · Original ITForMe practice mapped to published objectives; not an official exam question. A named independent subject-matter expert has not yet verified the question and answer key.

Community review →
3.1Plan and implement identities for applications and Azure workloads. 3.2Plan, implement, and monitor the integration of enterprise applications. 3.3Plan and implement app registrations.
Show review record and official sources

Method: Mapped to SC-300 objectives 3.1, 3.2, and 3.3; workload-identity state transitions, app-only permission scope, safe credential cutover, private final-state checks, and answer feedback reviewed.

Current-profile check: 2026-09-30 · Next review due 2026-10-27

01

Inspect the evidence

Use only the information provided to complete the tasks.

Inventory job trace

code
Resource          inventory-function (Azure Function)
Managed identity  disabled
Token request     delegated Inventory.Read
Result            rejected: user context required
Deployment scan   credential reference legacy-deployment-secret

Approved recovery boundary

list
  • ›The unattended job requires Inventory.Read.All as an application permission on inventory-api.
  • ›Prove token acquisition and API authorization through the replacement identity before retiring the legacy credential.
  • ›Do not create another secret, use a human account, or broaden the permission beyond the inventory API.
02

Complete the response

Partial credit is available for matching, ordering, and multi-select tasks.

Changes will save automatically.
01
powershell cli

Use the simulator-only workflow console to inspect the current identities and grants, establish the approved secretless path, verify it, and retire the legacy credential safely.

3 pts
identity-labITForMe PowerShell-style workflow console
Browser simulator
ITForMe simulator-only PowerShell-style workflow console. Commands change only fictional training state.
Need a hint?

Inspect the fictional training objects before changing them; use Get-Help to review the bounded simulator-only cmdlets.

Show another hint

Keep every change within the requested pilot scope, run the explicit validation cmdlets, and inspect the final state.

02
matching

Match each access case to the correct permission or consent model.

3 pts
Need a hint?

Start with the row and choice that have the most distinctive purpose, then use that pair to narrow the rest.

Show another hint

For each remaining pair, explain the relationship in one sentence before selecting it.

03
ordering

Order the identity repair steps.

4 pts

Drag the rows or use the arrow buttons to reorder.

  1. 1 Remove and revoke the exposed client secret
  2. 2 Grant the managed identity the least required API access
  3. 3 Enable the managed identity on the Function
  4. 4 Test token acquisition and API authorization
Need a hint?

Identify the prerequisite that must happen first and the verification or documentation that belongs last.

Show another hint

For the middle steps, ask what must already be true before each action can safely happen.

Ready to check your work?Unanswered tasks and matches earn no points. A partial submission is scored and saved in your history.
Persistent progress

Attempt history

Every submission is retained. Starting another attempt never replaces or unlocks the previous one.

No attempts yet

Your first submitted score and detailed answer review will appear here.

Community quality control

Question or answer look wrong?

Proposals and votes help staff prioritize review. They never change the scoring key automatically.

Full review queue →
No community corrections yet

Be the first to flag unclear wording, an answer-key issue, or a source that needs another look.

Propose a correction