Explanation:
User
Can Reset Passwords For
User1
User3 and User5 only
User4
User3 only
According to the Microsoft SC-300: Microsoft Identity and Access Administrator Study Guide and official Microsoft Learn documentation on role-based access control (RBAC) and administrative units (AUs) , the scope of administrative privileges determines which users an administrator can manage.
Role Review:
* Password Administrator (Organization scope): Can reset passwords for non-administrators and users with lesser pri vileges across the entire organization. They cannot reset passwords for Global Administrators or users with equal/higher roles.
* Global Reader (Organization scope): Read-only access-cannot perform administrative actions (including password resets).
* Password Administrator (Scoped to AU1): Can reset passwords for users within AU1 who are non- administrators and whose roles are less privileged than their own.
User
Role
Scope
Members in Administrative Unit
User1
Password Administrator
Organization
AU1
User2
Global Reader
Organization
AU1
User3
None
N/A
AU1
User4
Password Administrator
AU1
AU2
User5
None
N/A
None
Step 1 - For User1 (Org-scoped Password Administrator): User1's permissions apply organization-wide, allowing resets for:
* Users without admin roles, including those in or outside any AU.
* Cannot reset passwords for users with equal or higher roles (e.g., Global Reader, Password Administrator).
# Therefore, User1 can reset passwords for:
* User3 (no role, AU1)
* User4 (Password Administrator in AU2) - # cannot reset equal role
* User5 (no role, no AU) #
Final for User1 # User3 and User5 only
Step 2 - For User4 (AU1-scoped Password Administrator): User4's permissions apply only within AU1 and to users with lesser privileges.
Within AU1:
* User1 (Org Password Admin) - # higher privilege
* User2 (Global Reader) - # higher privilege
* User3 (no role) - # can reset
Final for User4 # User3 only

Explanation:
No
Yes
Yes
In Microsoft Entra/Azure RBAC, permissions are granted by role + scope and inherit down the hierarchy (subscription # resource group # resource). The SC-300 materials clarify that the Reader role is "a management-plane role that permits viewing resources but not modifying them or accessing data content s." Therefore, although Group1 has Reader at Sub1 , User1 (Group1, Group2) cannot read Key Vault secrets in Vault1 because Reader does not grant data-plane access. The study guide also notes for Azure Key Vault with RBAC: "Key Vault Secrets User can read se cret contents (get/list) for vaults in the assigned scope." Since Group2 holds Key Vault Secrets User at RG2 , any member of Group2 (including User2 ) can read secrets in Vault2 (which is in RG2 ). However, that assignment does not extend to RG1 , so it doesn' t help User1 with Vault1 . Finally, SC-300 coverage of built-in roles states: "Owner grants full access to all resources within the scope, including the ability to modify settings and delegate access." Because Group3 is Owner at RG1 , User3 can manage resour ces in RG1 , including updating the configuration of VM1 located there.
Result: User1 # No , User2 # Yes , User3 # Yes .

Per Microsoft SC-300 Exam Ref and Microsoft Learn module: Implement Continuous Access Evaluation (CAE) , continuous access evaluation is configured and enforced thr ough Conditional Access policies .
CAE enables near real-time enforcement of access decisions based on user or session changes such as account disablement, password reset, or location change - without waiting for token expiration. To apply CAE for specific user groups or roles (e.g., Application Administrators), administrators must create or edit a Conditional Access policy and ensure Continuous Access Evaluation is enabled for relevant cloud apps.
Settings like Admin consent , Sign-in risk policy , and Access reviews serve different functions and do not enable continuous enforcement.
Thus, to configure CAE and assign it to Application Administrators, you must use a Conditional Access policy .

Explanation:
VM1: Managed1 and Managed2 only
App1: A system-assigned managed identity and Managed2 only
Questions no: 269
Verified Answer :
* VM1: Managed1 and Managed2 only
* App1: A system-assigned managed identity and Managed2 only
Comprehensive and Detailed Explanation with all Microsoft SC-300: Identity and Access Administrator documents :
To answer this question, we must apply the principles of Managed Identities for Azure resource s .
Managed identities provide an automatically managed identity in Microsoft Entra ID for applications to use when connecting to resources that support Microsoft Entra authentication (like Azure Key Vault or SQL).
1. Understanding Identity Types:
* User Obje cts (User1): Standard user accounts are used for human sign-ins. You cannot assign a standard user object (like User1) as the identity of an Azure resource (like a VM or App Service). The resource must use a Service Principal or Managed Identity. Therefore , any option including User1 is incorrect.
* User-Assigned Managed Identities (Managed1, Managed2): These are standalone Azure resources that can be assigned to one or more Azure resources (like VMs or App Services).
* System-Assigned Managed Identities: These are enabled directly on the resource itself and share the resource ' s lifecycle.
2. Analysis for VM1:
* Azure Virtual Machines support User-assigned managed identities .
* You can assign multiple user-assigned identities to a single VM.
* Looking at the dropdown options for VM1:
* Options with User1 are invalid.
* This leaves Managed2 only or Managed1 and Managed2 only.
* Since both Managed1 and Managed2 are valid user-assigned identities available in the subscription, you can assign both.
* Conclusion: Select Managed1 and Managed2 only .
3. Analysis for App1:
* Azure App Services support both System-assigned and User-assigned managed identities concurrently.
* Looking at the dropdown options for App1:
* Options with User1 are invalid.
* Managed1 is not listed in the dropdown opt ions (Managed identities must be in the same region as the resource; often this question implies a region mismatch, or simply restricts the choice).
* Managed2 is listed as a valid user-assigned option.
* A system-assigned managed identity is listed as a valid option.
* Since you can configure an App Service to use both its system-assigned identity and a user- assigned identity simultaneously, the most complete correct answer identifies all capable identities.
* Conclusion: Select A system-assigned managed identity and Managed2 only .
Reference Extract:
" Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory... There are two types of managed identities: System-assigned ... and User-assigned
... You can assign a user-assigned managed identity to [Azure Virtual Machines and Azure App Service]. " (Source: Microsoft Learn - What are managed identities for Azure resources?)

According to Microsoft's SC-300: Microsoft Identity and Access Administrator Study Guide and Exam Ref SC-300, the behavior of the sign-in process depends on which authentication methods are enabled for the user or their group. Azure AD supports multiple strong authentication methods, such as Microsoft Authenticator app, FIDO2, and SMS, which can be targeted to specific user groups.
The question specifies that the tenant's configuration enables the following methods:
* FIDO2 # Group2 (Yes)
* Microsoft Authenticator app # Group1 (Yes)
* SMS # Group3 (Yes)
And user membership is:
* User1 # Group1
* User2 # Group2
* User3 # Group3
The key phrase in the question is:
"Sign in to cloud apps by matching a number shown in the app with a number shown on their phone." This specific sign-in experience refers to the number matching feature in the Microsoft Authenticator app.
* Number matching is a security enhancement in Azure AD MFA that requires the user to confirm a sign- in by matching a number displayed on the sign-in screen with the number shown in their Microsoft Authenticator app notification.
* According to Microsoft Learn:
"When using the Microsoft Authenticator app for MFA, users will be prompted to enter or match a number displayed on the screen. This feature strengthens authentication by preventing accidental approvals." Therefore:
* Only User1, who is a member of Group1 (the group enabled for Microsoft Authenticator app), will experience number matching when signing in.
* User2 uses FIDO2, which employs a hardware key or biometric verification - not number matching.
* User3 uses SMS, which involves a one-time passcode (OTP) - again, not number matching.
Hence, only User1 will sign in to cloud apps using number matching.