Explanation:
Statement
Yes / No
If User1 requests Role1, the request will be approved automatically.
No
User1 can approve the request of User3 for Role2.
No
User1 must provide justification to approve the request of User2 for Role1.
Yes
According to the Microsoft SC-300 study guide, Exam Ref SC-300, and Microsoft Entra Privileged Identity Management (PIM) documentation, role activation and assignment settings in Azure AD PIM determine who can activate roles, who can approve activations, and whether justification is required. Let's analyze each configuration step-by-step.
Role1 Configuration Summary Setting
Value
Required justification on activation
No
Require approval to activate
Yes
Approvers
User1
Allow permanent eligible assignment
Yes
Allow permanent active assignment
Yes
Require justification on active assignment
Yes
Eligible Assignments: User1, User2
Role2 Configuration Summary Setting
Value
Required justification on activation
Yes
Require approval to activate
No
Approvers
None
Allow permanent eligible assignment
No
Allow permanent active assignment
Yes
Require justification on active assignment
Yes
Eligible Assignments: User3
Statement 1: "If User1 requests Role1, the request will be approved automatically."
* Role1 requires approval to activate.
* The approver is User1, but a user cannot self-approve their own request in Azure AD PIM.
* Therefore, even though User1 is listed as an approver, the system does not automatically approve self- requests.
# Answer: No
Statement 2: "User1 can approve the request of User3 for Role2."
* Role2 does not require approval to activate (approval = No).
* User3 is the only eligible member for Role2 and can activate it directly.
* Hence, no approval action exists for User1.
# Answer: No
Statement 3: "User1 must provide justification to approve the request of User2 for Role1."
* Role1 requires approval to activate, and User1 is the approver.
* The assignment settings for Role1 state: Require justification on active assignment = Yes.
* This means when approving or activating, the approver (User1) must enter a justification before approval.
# Answer: Yes

Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn documentation under "Manage Administrative Units in Azure Active Directory", Administrative Units (AUs) provide a way to delegate administrative permissions over subsets of Azure AD resources - such as specific users or groups - without granting directory-wide privileges.
* Department1 Administrative Unit contains User1, User2, Group1, and Group2.
* Admin1 is assigned the User Administrator role scoped to Department1 AU.
* Admin2 is assigned the User Administrator role scoped to the entire directory.
# Context Overview
* User3 and User4 are not members of Department1 AU - they belong only to Group2, but group membership does not automatically bring those users under AU scope.
* Admin1's permissions are limited strictly to users and groups within the Department1 AU. # Conclusion: Admin1 cannot reset the passwords of User3 and User4. Answer: No Statement 1: Admin1 can reset the passwords of User3 and User4.
* Both User1 and Group2 are in the Department1 AU, but in Azure AD, the User Administrator role scoped to an AU cannot manage group memberships unless explicitly delegated with Group Administrator privileges or unless the AU is configured to allow it.
* The User Administrator role allows password reset and user management, not group membership management. # Conclusion: Admin1 cannot add User1 to Group2. Answer: No Statement 2: Admin1 can add User1 to Group2.
* Admin2 has the User Administrator role assigned at the directory level, meaning global scope.
* Therefore, Admin2 can manage user credentials, including password resets, for all users in the tenant - including User1. # Conclusion: Admin2 can reset the password of User1. Answer: Yes Statement 3: Admin2 can reset the password of User1.
Supporting Reference (Microsoft Learn):
"Administrative units restrict scope for delegated administrators. A User Administrator scoped to an AU can reset passwords only for users in that AU. A User Administrator assigned at the directory level can reset passwords for any user."

Explanation:

According to the Microsoft Entra External Identities module within the SC-300 curriculum, control over which external domains can be invited as guest users is managed under External collaboration settings i n the Entra admin center.
Administrators can specify "Allow invitations only to the specified domains" and list approved domains.
This ensures that guest invitations can only be sent to trusted business partners while blocking all others.
Cross-tenant access settings control authentication and access policies between trusted tenants, not invitation restrictions. Linked subscriptions and identity providers manage billing and authentication federation but do not control guest invitations.
Therefore, to re strict guest invitations to specific external domains, you must configure the External collaboration settings in Microsoft Entra ID.