Microsoft · certification · Guided course

Microsoft Certified: Identity and Access Administrator Associate

Manage workforce identities, authentication, application access, and identity governance in Microsoft Entra.

Daily study planConsideringInclude new SC-300 sections and checks in your daily goal.

Catalog noteThe April 27, 2026 skills remain the active English blueprint through October 27. Microsoft has announced an English-language update effective October 28, 2026; this route must be remapped at cutover.Provider catalog checked 2026-08-12.

Your course path

Start with the suggested objective

Open a section when you are ready to begin.

Course pace and remaining work

ApproachBuild in orderLearning; no professional IT experience yet

Core work left2096mRemaining short lesson blocks and checks · outside courses vary in length

Target paceNo deadlineSet a target below to calculate required weekly time

Implement and manage user identitiesNot started

1.1 · Configure and manage a Microsoft Entra tenant.

4 short lesson blocks · next block about 12m

Block 1 · Company branding · Custom domain name

○Study lessonRequired provider lesson ○Block check

Block 2 · Administrative unit · Microsoft Entra built-in role · Microsoft Entra custom role · Effective role permissions

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Tenant properties · Tenant user group and device settings

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Delegate tenant administration without widening scope

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 5Start section →

Full course map15 other objectivesOpen when you want to review progress or look ahead

Implement and manage user identitiesNot started

1.2 · Create, configure, and manage Microsoft Entra identities.

4 short lesson blocks · next block about 12m

Block 1 · Cloud-only user · Assigned membership group

○Study lessonRequired provider lesson ○Block check

Block 2 · Dynamic membership group · Group-based licensing · Bulk user operation

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Custom security attribute · Device join and registration management · Direct user license assignment

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Drive identity lifecycle from governed attributes

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 9Start section →

Implement and manage user identitiesNot started

1.3 · Manage external users and cross-tenant access.

7 short lesson blocks · next block about 15m

Block 1 · B2B collaboration · Cross-tenant access settings

○Study lessonRequired provider lesson ○Block check

Block 2 · B2B direct connect · External collaboration settings

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand External identity provider

○Study lessonRequired provider lesson ○Block check

Block 4 · Understand Guest access review

○Study lessonRequired provider lesson ○Block check

Block 5 · Understand Connected organization

○Study lessonRequired provider lesson ○Block check

Block 6 · Understand Cross-tenant synchronization

○Study lessonRequired provider lesson ○Block check

Block 7 · Control external collaboration across tenant boundaries

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 16Start section →

Implement and manage user identitiesNot started

1.4 · Implement and manage hybrid identity.

5 short lesson blocks · next block about 12m

Block 1 · Password hash synchronization · Pass-through authentication

○Study lessonRequired provider lesson ○Block check

Block 2 · Microsoft Entra Connect Sync · AD FS authentication migration · Seamless single sign-on · Connect staging mode

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Understand Microsoft Entra Connect Health

○Study lessonRequired provider lesson ○Block check

Block 4 · Understand Microsoft Entra Cloud Sync

○Study lessonRequired provider lesson ○Block check

Block 5 · Select and operate a resilient hybrid identity path

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 22Start section →

Implement authentication and access managementNot started

2.1 · Plan and implement Microsoft Entra user authentication.

6 short lesson blocks · next block about 12m

Block 1 · FIDO2 security key or passkey · Windows Hello for Business

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Microsoft Authenticator passwordless sign-in · Self-service password reset · Microsoft Entra Password Protection

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Microsoft Entra Kerberos · Tenant-wide MFA settings

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Authentication methods policy · Temporary Access Pass · Certificate-based authentication · Authentication strength

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Understand Revoke user sessions

○Study lessonRequired provider lesson ○Block check

Block 6 · Bootstrap phishing-resistant authentication safely

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byNov 28Start section →

Implement authentication and access managementNot started

2.2 · Plan, implement, and manage Conditional Access.

6 short lesson blocks · next block about 12m

Block 1 · Conditional Access policy · Grant control

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Report-only mode · Conditional Access What If · Emergency account exclusion · Named location

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Conditional Access device filter · Session control · Continuous Access Evaluation

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Conditional Access authentication context · Protected action

○Study lessonRequired provider lesson ○Block check

Block 5 · Understand App-enforced restriction

○Study lessonRequired provider lesson ○Block check

Block 6 · Roll out Conditional Access with observable safeguards

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 4Start section →

Implement authentication and access managementNot started

2.3 · Manage identity risk with Microsoft Entra ID Protection.

4 short lesson blocks · next block about 12m

Block 1 · User risk · Sign-in risk · Risk-based Conditional Access policy

○Study lessonRequired provider lesson ○Block check

Block 2 · Microsoft Entra ID Protection risk detection · Risky user remediation · Confirm user compromised · Risky sign-in investigation

○Study lessonRequired provider lesson ○Block check

Block 3 · Understand Risky workload identity

○Study lessonRequired provider lesson ○Block check

Block 4 · Respond to user, sign-in, and workload risk

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 8Start section →

Implement authentication and access managementNot started

2.4 · Implement secure access with Microsoft Entra Global Secure Access.

4 short lesson blocks · next block about 12m

Block 1 · Microsoft Entra Internet Access · Microsoft Entra Private Access

○Study lessonRequired provider lesson ○Block check

Block 2 · Global Secure Access · Traffic forwarding profile · Compliant network condition · Global Secure Access remote network

○Study lessonRequired provider lesson ○Block check

Block 3 · Private Network connector · Global Secure Access traffic logs

○Study lessonRequired provider lesson ○Block check

Block 4 · Route identity-aware traffic through Global Secure Access

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 13Start section →

Plan and implement workload identitiesNot started

3.1 · Plan and implement identities for applications and Azure workloads.

5 short lesson blocks · next block about 15m

Block 1 · System-assigned managed identity · User-assigned managed identity · Managed identity role assignment

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Service principal · Workload identity federation

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Understand Conditional Access for workload identities

○Study lessonRequired provider lesson ○Block check

Block 4 · Application certificate credential · Application client secret

○Study lessonRequired ITForMe lesson ○Block check

Block 5 · Remove stored secrets from workload identity

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 18Start section →

Plan and implement workload identitiesNot started

3.2 · Plan, implement, and monitor the integration of enterprise applications.

7 short lesson blocks · next block about 12m

Block 1 · Enterprise application gallery · Application consent policy

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Enterprise application · User and group assignment · Cloud Application Administrator role · Application collection

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · User consent setting · Enterprise application sign-in monitoring

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Understand Automatic application provisioning

○Study lessonRequired provider lesson ○Block check

Block 5 · Understand Microsoft Entra application proxy

○Study lessonRequired provider lesson ○Block check

Block 6 · SAML-based single sign-on · Claims mapping policy

○Study lessonRequired ITForMe lesson ○Block check

Block 7 · Integrate enterprise applications and prove lifecycle

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 25Start section →

Plan and implement workload identitiesNot started

3.3 · Plan and implement app registrations.

4 short lesson blocks · next block about 12m

Block 1 · App registration · API permission

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Redirect URI · Expose an API · Application manifest

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Tenant-wide admin consent · Application role · Optional claim

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Design app registration permissions and tokens

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byDec 29Start section →

Plan and implement workload identitiesNot started

3.4 · Manage and monitor application access with Microsoft Defender for Cloud Apps.

4 short lesson blocks · next block about 12m

Block 1 · Cloud Discovery · Defender for Cloud Apps connector

○Study lessonRequired provider lesson ○Block check

Block 2 · Sanctioned application · OAuth app governance · Defender for Cloud Apps activity policy

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Defender for Cloud Apps session policy · Defender for Cloud Apps access policy · Conditional Access App Control

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Govern cloud application sessions and OAuth access

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 2Start section →

Plan and automate identity governanceNot started

4.1 · Plan and implement entitlement management.

4 short lesson blocks · next block about 12m

Block 1 · Access package · Entitlement management catalog

○Study lessonRequired provider lesson ○Block check

Block 2 · Access package assignment policy · Access package assignment · Access request approval · Entitlement assignment expiration

○Study lessonRequired provider lesson ○Block check

Block 3 · Terms of Use · Entitlement sponsor

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Build requestable access with automatic expiry

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 7Start section →

Plan and automate identity governanceNot started

4.2 · Plan, implement, and manage access reviews.

4 short lesson blocks · next block about 12m

Block 1 · Group access review · Application access review

○Study lessonRequired provider lesson ○Block check

Block 2 · Privileged role access review · Recurring access review · Access review reviewer

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Auto-apply access review results · Inactive-user review scope · Access review decision helper

○Study lessonRequired provider lesson ○Block check

Block 4 · Run access reviews that change real access

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 11Start section →

Plan and automate identity governanceNot started

4.3 · Plan and implement privileged access.

4 short lesson blocks · next block about 15m

Block 1 · PIM for Azure resources · PIM role settings

○Study lessonRequired provider lesson ○Block check

Block 2 · PIM eligible role assignment · PIM active role assignment · PIM role activation · PIM activation approval

○Study lessonRequired provider lesson ○Block check

Block 3 · PIM for Groups · Emergency access account

○Study lessonRequired ITForMe lesson ○Block check

Block 4 · Make privilege eligible, bounded, and recoverable

○Study lessonRequired provider lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 16Start section →

Plan and automate identity governanceNot started

4.4 · Monitor identity activity by using logs, workbooks, and reports.

5 short lesson blocks · next block about 12m

Block 1 · Microsoft Entra sign-in log · Microsoft Entra audit log

○Study lessonRequired ITForMe lesson ○Block check

Block 2 · Microsoft Entra diagnostic setting · Log Analytics workspace · Microsoft Entra workbook

○Study lessonRequired ITForMe lesson ○Block check

Block 3 · Identity Secure Score · Microsoft Entra usage and insights

○Study lessonRequired provider lesson ○Block check

Block 4 · Understand Provisioning log

○Study lessonRequired provider lesson ○Block check

Block 5 · Construct KQL and correlate identity evidence

○Study lessonRequired ITForMe lesson ○Block check

○Checkpoint · 70%+ ○Spaced review 0/3

Suggested byJan 21Start section →

★

Course progression checks

Complete these quizzes and labs to finish the guided course. The readiness checklist below has additional requirements. Course completion does not predict your exam result.

○Pass both current-profile 90-question final forms at 85%+ within 180 days○Pass 4 distinct current in-browser scenarios whose mapped content spans 4 exam domains at 70%+ within 180 days

Open practice →

Optional learning resources1 choiceOpen for another teacher, format, or question review

Optional

Another explanation or review

Hosted study uses small official Learn unit sets plus ITForMe checks; tenant-based external labs are not assigned. These resources do not change course progress or readiness.

Microsoft LearnOfficial Learning Paths · Free

Microsoft Identity and Access Administrator

The learning paths are free. A tenant or subscription may be needed for realistic hands-on practice.

Self-paced course · Free modules; optional paid instruction

Open resource ↗

Checked 2026-08-18 · review due 2027-02-14