SC-900 Part 2: Microsoft Entra Capabilities (diagrams, labs and an interactive quiz)

Domain 2 is worth 25–30% of SC-900 and it is the domain that pays off the most in a real job, because identity is where most support tickets and most attacks live.

Three things carry this domain: knowing the objects in a tenant, knowing the authentication methods, and knowing which licence tier unlocks what.

Objectives updated July 28, 2026. Verify names and tiers on Microsoft Learn — Microsoft renames things in this area constantly (Azure AD → Microsoft Entra ID; Azure AD B2C → Microsoft Entra External ID).

---

1. What Microsoft Entra ID is (and isn't)

Microsoft Entra ID is a cloud-based identity and access management service. It is not Active Directory in the cloud.

	Active Directory Domain Services	Microsoft Entra ID
Where	On-premises servers	Cloud service
Protocols	Kerberos, LDAP, NTLM	SAML, OAuth 2.0, OpenID Connect, SCIM
Structure	Forests, domains, OUs, GPOs	Flat tenant + groups + administrative units
Manages	Domain-joined Windows devices	Any device, any platform, SaaS apps

They complement each other. Hybrid identity connects the two with Microsoft Entra Connect (or Connect cloud sync), using one of:

• Password hash synchronization (PHS) — a hash of the password hash syncs to the cloud. Simplest, and it keeps working if your on-prem servers are down.
• Pass-through authentication (PTA) — the cloud passes the validation to an on-prem agent. Passwords never sync.
• Federation (AD FS) — a separate on-prem infrastructure handles authentication.

2. The objects inside a tenant

• Users: member accounts (your employees) and guest accounts (B2B collaboration, invited from another organization).
• Groups: security groups (permissions) and Microsoft 365 groups (collaboration: mailbox, SharePoint site, Teams). Membership can be assigned (manual) or dynamic (rule-based, requires P1).
• Devices: registered (usually personal, BYOD), Entra joined (cloud-only corporate device), hybrid joined (joined to on-prem AD and to Entra).
• Roles (RBAC): Global Administrator, User Administrator, Security Reader, and dozens more. Least privilege applies — don't hand out Global Admin.
• Administrative units: scope a role to a subset of the directory (for example "help desk admin, but only for the Madrid office").
• Applications: enterprise applications (SaaS you connect) and app registrations (apps you build).
• Workload identities: service principals and managed identities — identities for apps and services, not people.

Also in the Entra family, worth recognizing by name:

• Microsoft Entra External ID — identities for customers and partners (formerly Azure AD B2C).
• Microsoft Entra ID Governance — entitlement management, access reviews, lifecycle workflows.
• Microsoft Entra Permissions Management — CIEM: permission visibility across Azure, AWS and GCP.
• Microsoft Entra Verified ID — decentralized, verifiable credentials.
• Microsoft Entra Global Secure Access (Internet Access / Private Access) — identity-centric network access.

3. Authentication methods

Ordered roughly from weakest to strongest:

1. Password only — weakest.
2. SMS or voice call — better than nothing, vulnerable to SIM swapping. Microsoft discourages it.
3. Microsoft Authenticator with number matching — strong and cheap.
4. OATH hardware/software tokens.
5. Windows Hello for Business — biometric/PIN tied to the device, phishing-resistant.
6. FIDO2 security keys / passkeys — phishing-resistant, the current gold standard.
7. Certificate-based authentication — common in regulated environments.

Related features:

• Self-service password reset (SSPR) — users reset their own password after verifying with registered methods; reduces help desk load.
• Password protection — bans weak and custom-banned passwords, including on-prem when the agent is deployed.
• Multifactor authentication (MFA) — something you know, something you have, something you are.
• Passwordless — Authenticator app, FIDO2 keys, Windows Hello.

4. Conditional Access

Conditional Access is the if-this-then-that engine of Zero Trust. It evaluates signals, makes a decision, and enforces controls.

Common signals: user or group membership, IP location, device platform and compliance state, target application, real-time sign-in risk and user risk (those last two require Identity Protection).

Common decisions: grant access, grant with conditions (require MFA, require compliant device, require approved client app, require terms of use), or block access. There are also session controls, such as limiting the session lifetime or enforcing app-enforced restrictions.

A classic policy: "If any user accesses the Azure management portal from an untrusted location, require MFA."

5. The licensing table (memorize this one)

Feature	Free	P1	P2
Security defaults	✅	✅	✅
SSO, basic MFA, self-service password change for cloud users	✅	✅	✅
Self-service password reset with on-premises write-back	❌	✅	✅
Conditional Access	❌	✅	✅
Dynamic groups, group-based licensing	❌	✅	✅
Identity Protection (risk-based policies)	❌	❌	✅
Privileged Identity Management (PIM)	❌	❌	✅
Access reviews	❌	❌	✅

(Governance features may also ship in the Entra ID Governance SKU. Confirm current packaging on Microsoft Learn before the exam.)

Security defaults deserve a note: they're a free, all-or-nothing baseline (MFA for admins, MFA registration for everyone, blocking legacy authentication). You cannot customize them — the moment you need exceptions, you turn them off and move to Conditional Access, which means P1.

6. Identity governance quick reference

• PIM — makes privileged roles eligible instead of permanently assigned. The admin activates the role for a limited time, with justification and approval. This is the exam's favourite example of just-in-time access.
• Access reviews — periodic attestation: "does this person still need this access?"
• Entitlement management — access packages that bundle groups, apps and sites, with an approval workflow and an expiration date.
• Lifecycle workflows — automate joiner/mover/leaver tasks.

---

🧪 Lab 1: users, groups and dynamic membership

Time: 15 minutes. Needs: Entra tenant (Free tier is enough for the first part; dynamic groups need P1 trial).

1. Entra admin center → Users → New user. Create usr.ana with department Sales, and usr.luis with department IT.
2. Groups → New group → Security → Assigned. Name it grp-all-staff, add both users.
3. Now create grp-sales-dynamic as a Dynamic User group with the rule: user.department -eq "Sales"
4. Wait a few minutes and check the membership: only Ana is there.
5. Edit Luis and change his department to Sales. Wait, refresh, and watch him appear automatically.

Expected result: you can explain, out loud, why dynamic groups reduce administrative work and why they need P1. That's an exam answer.

🧪 Lab 2: your first Conditional Access policy

Time: 15 minutes. Needs: Entra ID P1 or P2 trial. Warning: always exclude a break-glass account so you don't lock yourself out.

1. Entra admin center → Protection → Conditional Access → Create new policy.
2. Users: include All users, exclude your admin account.
3. Target resources: All cloud apps.
4. Conditions → Locations: include Any location, exclude a named location you created with your own country.
5. Grant: Require multifactor authentication.
6. Set the policy to Report-only first. Look at the "Insights and reporting" workbook to see who would have been affected.
7. Only then switch it to On and test with a VPN set to another country.

Expected result: a screenshot of the sign-in log showing the policy applied. That screenshot is worth more in an interview than the certificate itself.

Then check yourself

The licensing table and these Conditional Access scenarios are both on the interactive practice page — the licence tiers grade themselves, and the policy builder tells you why each condition and control is the right one.

---

⚠️ Exam traps in this domain

• Conditional Access = P1. Identity Protection and PIM = P2. Expect at least one question on this.
• Security defaults and Conditional Access are mutually exclusive — you can't run both.
• Dynamic groups need P1, and the membership rule is evaluated by attribute, not by manual add.
• Guest (B2B) users live in your tenant as guest accounts; they authenticate against their home tenant.
• Managed identity vs service principal: a managed identity is a service principal that Azure manages for you (no secrets to rotate).
• Entra ID is not a domain controller. No GPOs, no LDAP, no Kerberos to on-prem servers by default.

---

🎯 Now practise it: 12 questions + both labs

This domain is where licence tiers decide the answer, and you don't find out whether you really know the split until something asks you.

So the practice lives in an interactive page instead of a list you can scroll past:

👉 Take the Part 2 quiz and labs

What you get:

• 12 exam-style questions. Pick an answer and you immediately see why it's right — and why each of the other three is wrong. The distractors are the real ones: PTA vs federation, Entra ID vs External ID, PIM vs access reviews.
• Options shuffled on every attempt, so retaking it tests the concept instead of the position you memorized.
• Lab 3 — the licensing table. Nine features, and you pick the minimum tier for each. It grades every row and explains the misses.
• Lab 4 — build a Conditional Access policy. Three requirements in plain English; you choose the condition and the control that implement them.

Domain 1 is on the same page, so you can go back and forth.

Free, no sign-up, works on your phone.

Come back and comment your score out of 12 — and if the licensing table caught you, say so. You won't be the only one.

---

What's next

Part 3 is the biggest domain of the exam: Microsoft security solutions — 35–40%. That's where the Defender family lives, and where most people mix up nine similarly named products. I'll give you the one diagram that fixes it.