Explanation:

In Microsoft Entra Permissions Management (formerly CloudKnox), onboarding an Azure subscription requires granting the Permissions Management service principal the minimum rights needed to discover identities, roles, and permissions across that subscription. The SC-300 materials emphasize the principle of least privilege for onboarding: assign Reader at the subscription scope so the service can inventory resources and permissions without the ability to change them. After onboarding, if you want automated remediation/right-sizing, you can additionally grant User Access Administrator (or perform changes manually), but that elevation is not required merely to onboard and collect data.
Accordingly, you complete the PowerShell by creating an RBAC assignment for the application (service principal) at the subscription scope using New-AzRoleAssignment and specifying -RoleDefinitionName Reader. Creating a new custom role (New-AzRoleDefinition) is unnecessary, and New-AzTag is unrelated to RBAC. Choosing Owner or Contributor would exceed the access required for onboarding and violate least-privilege guidance. The correct, minimal configuration is therefore: assign Reader to the Permissions Management application at the /subscriptions/<SubscriptionId> scope using New-AzRoleAssignment.

The Conditional Access What If tool is designed to simulate sign-ins under various conditions to test Conditional Access policies without performing real sign-ins . Microsoft's SC-300 guide specifies that this tool is essential for validating the effect of a policy based on user, location, device, or risk l evel.
In this case, the administrator wants to test a policy that blocks access when a high-severity sign-in alert (sign-in risk) occurs and when a user signs in from another country . These scenarios are based on risk and location conditions-both supported in the What If tool simulation.
Microsoft Learn: "Use the What If tool to simulate sign-ins and verify whether a specific Conditional Access policy will be applied."

In Microsoft 365, Basic authentication is an outdated protocol that sends credentials in plain text and does not support MFA. To enforce Modern authentication (OAuth 2.0), which is required for stronger identity protection and token-based access, administrators must block legacy authentication using Conditional Access policies in Azure AD.
According to the SC-300 study guide and Microsoft Learn module "Implement Conditional Access policies" , this can be achieved by:
* Creating a Conditional Access policy in Azure AD.
* Targeting the Exchange Online cloud app.
* Setting the condition Client apps # Other clients (legacy authentication) to block access.
Modern authentication clients (like Outlook 2016+, Outlook on the web, and Outlook mobile) use secure OAuth tokens that comply with Conditional Access requirements (such as MFA, device compliance, or trusted location).
Compliance policies or application control profiles in Microsoft Endpoint Manager do not manage authentication protocols, and Microsoft Cloud App Security OAuth policies govern third-party app permissions, not Exchange connectivity.
Therefore, the correct approach to ensure only Modern authentication clients can connect is to enforce this through a Conditional Access policy in Azure AD.

According to the official Microsoft SC-300: Microsoft Identity and Access Administrator St udy Guide and Exam Ref SC-300 textbook, when configuring Entitlement Management in Azure AD Identity Governance
, connected organizations are used to define which external directories or domains are allowed to request access to specific access packages. A c onnected organization represents a single external organization whose users can be invited as guests (B2B collaboration users) or allowed to request access packages.
Each connected organization is identified by its verified domain names. For example, if yo u have two separate companies, Fabrikam, Inc. and Litware, Inc. , and they each have distinct verified domains - fabrikam.com, adatum.com (for Fabrikam), and litwareinc.com, contoso.com (for Litware) - they must each be configured as separate connected orga nizations because connected organizations are defined at the organization level, not per domain.
Even though each organization may have multiple verified domains, the configuration treats all of an organization's verified domains as part of the same connec ted organization. Therefore, to allow users from both Fabrikam and Litware to request access to Package1 , you must create two connected organizations - one for Fabrikam and one for Litware.
This behavior is confirmed in Microsoft documentation and training modules under "Manage connected organizations" in Azure AD Entitlement Management, which states that "each external organization that requires access must have its own connected organization entry, regardless of how many domains it owns."