Microsoft SC-300 (Identity & Access Administrator)

A new admin inherits a tenant and is asked to find a user. They open the Azure portal, pick a subscription, and look for the user under its access control blade. The user isn't there, because users don't live in subscriptions. Start with the boundary.

A tenant is a dedicated instance of Microsoft Entra ID, created the first time an organization signs up for a Microsoft cloud service. It holds users, groups, devices, application objects and policies, and it is the security and administrative boundary for all of them. An Azure subscription is a billing and resource container that trusts one tenant for authentication. One tenant can hold many subscriptions; a subscription trusts exactly one tenant at a time. Moving a subscription to a different tenant removes the Azure role assignments in it, because the identities those assignments pointed to don't exist in the new tenant. Know which ID you are looking at: the tenant ID (also called directory ID) and a subscription ID are both GUIDs and they are routinely confused in tickets.

Domains. Every tenant has an initial domain such as contoso.onmicrosoft.com that can't be removed. You add custom domains and prove ownership by publishing a DNS TXT or MX record that Microsoft reads back; a domain can be verified in only one tenant at a time. One verified domain is set as the primary domain, the default suffix for new users. Whether a domain is managed (cloud authentication) or federated (sign-in redirected to an identity provider such as AD FS) matters for authentication and is covered in Identity Federation & SSO: SAML, OAuth2, and OIDC in Practice.

Tenant-wide settings you should read on day one. SC-300 lists tenant properties, user settings, group settings and device settings as configuration skills. The ones that change your risk:

• Users can register applications (User settings). On by default. Any member can create an app registration, which is how unowned apps accumulate; the Workload Identities module covers the trade-off.
• Restrict access to Microsoft Entra admin center. This hides the portal from non-admins. Microsoft's documentation states it isn't a security control: it does not block Microsoft Graph or PowerShell. Don't present it as one.
• Guest and external collaboration settings. Covered in External Identities: B2B Collaboration, Guest Access & the Lifecycle Nobody Runs.
• Device settings: who may join devices to Entra ID and who may register them. Microsoft recommends using the Conditional Access user action Register or join devices to require MFA for registration rather than the older tenant-wide MFA toggle on the device settings page.
• Company branding: logo, background and sign-in page text. It helps users recognize your real sign-in page. It is not a phishing control, because attackers can copy what your page shows.

Limit: the tenant boundary is strong for identity, but data can still leave it through guests, apps with application permissions and synchronization. Those paths have their own modules.