Version : 1.0 · Date : 2026-10-22
Cours complet pour l'examen SC-300 : Microsoft Identity and Access Administrator (certification Microsoft Certified: Identity and Access Administrator Associate), compétences mesurées au 28 octobre 2026. Un chapitre par bloc de compétences, au niveau administrateur : portail Microsoft Entra, PowerShell Microsoft Graph, API Graph, dépannage, licences et rôles requis. Ce que le cours SC-500 traite déjà (PIM, Conditional Access, authentication methods, applications, managed identities, compléments AZ-500) y est renvoyé plutôt que répété. Toutes les informations viennent de Microsoft Learn, lues les 21 et 22/10/2026. Les noms de services, fonctionnalités, rôles et menus sont en anglais, comme dans le portail et à l'examen.
Le guide se contredit sur le poids d'Implement authentication and access management (25-30 % dans le résumé, 20-25 % dans le détail) : le cours retient 25-30 %. Relire le guide SC-300 avant l'examen. Une évaluation d'entraînement officielle et gratuite existe sur Microsoft Learn.
Les domaines de l'examen#
| Domaine (intitulé officiel, en anglais) | Poids | Chapitres |
|---|---|---|
| Implement and manage user identities | 20 à 25 % | 01, 02, 03 |
| Implement authentication and access management | 25 à 30 % | 04, 05, 06 |
| Plan and implement workload identities | 20 à 25 % | 07, 08 |
| Plan and automate identity governance | 20 à 25 % | 09, 10 |
Score de réussite : 700 sur 1000.
Les chapitres#
Chaque chapitre suit le même plan : ce que l'examen demande (texte officiel), concepts, schémas, mise en œuvre (portail, PowerShell, Graph), tableaux comparatifs, labs conseillés, pièges d'examen, scénarios corrigés, pour aller plus loin, fiche à retenir et références.
Couverture des objectifs de l'examen#
Les 98 compétences du guide d'étude, chacune reliée à la section qui la traite (vérification du 22/10/2026).
Implement and manage user identities (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 01 | Configure and manage built-in and custom Microsoft Entra roles | 2 |
| 01 | Recommend when to use administrative units | 3.1 |
| 01 | Configure and manage administrative units | 3.2 |
| 01 | Evaluate effective permissions for Microsoft Entra roles | 4 |
| 01 | Configure and manage domains in Microsoft Entra ID and Microsoft 365 | 5 |
| 01 | Configure Company branding settings | 6 |
| 01 | Configure tenant properties, user settings, group settings, and device settings | 7 |
| 01 | Create, configure, and manage users | 8 |
| 01 | Create, configure, and manage groups | 9 |
| 01 | Manage custom security attributes | 10 |
| 01 | Automate bulk operations by using the Microsoft Entra admin center and PowerShell | 11 |
| 01 | Manage device join and device registration in Microsoft Entra ID | 12 |
| 01 | Assign, modify, and report on licenses | 13 |
| 02 | Manage External collaboration settings in Microsoft Entra ID | 2 |
| 02 | Invite external users, individually or in bulk | 3 |
| 02 | Manage external user accounts in Microsoft Entra ID | 4 |
| 02 | Implement Cross-tenant access settings | 5 |
| 02 | Implement and manage cross-tenant synchronization | 6 |
| 02 | Configure external identity providers, including protocols such as SAML and WS-Fed | 7 |
| 03 | Implement and manage Microsoft Entra Connect Sync | 2 |
| 03 | Implement and manage Microsoft Entra Cloud Sync | 3 |
| 03 | Implement and manage password hash synchronization | 4 |
| 03 | Implement and manage pass-through authentication | 5 |
| 03 | Implement and manage seamless single sign-on (SSO) | 6 |
| 03 | Migrate from AD FS to other authentication and authorization mechanisms | 7 |
| 03 | Implement and manage Microsoft Entra Connect Health | 8 |
Implement authentication and access management (25 à 30 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 04 | Plan for authentication | 2 |
| 04 | Implement and manage authentication methods, including certificate-based authentication, Temporary Access Pass, Microsoft Authenticator, and passkeys (FIDO2) | 3 |
| 04 | Implement and manage tenant-wide multifactor authentication (MFA) settings | 4 |
| 04 | Configure and deploy self-service password reset (SSPR) | 5 |
| 04 | Implement and manage Windows Hello for Business | 6 |
| 04 | Disable accounts and revoke user sessions | 7 |
| 04 | Implement and manage Microsoft Entra password protection | 8 |
| 04 | Enable Microsoft Entra Kerberos authentication for hybrid identities | 9 |
| 05 | Plan Conditional Access policies | 2 |
| 05 | Implement Conditional Access policy assignments | 3 |
| 05 | Implement Conditional Access policy controls | 4 |
| 05 | Test and troubleshoot Conditional Access policies | 7 |
| 05 | Implement session management | 5 |
| 05 | Implement device-enforced restrictions | 6 |
| 05 | Implement continuous access evaluation | 8 |
| 05 | Configure authentication context | 9 |
| 05 | Implement protected actions | 10 |
| 05 | Create a Conditional Access policy from a template | 11 |
| 06 | Implement and manage user risk by using Microsoft Entra ID Protection or Conditional Access policies | 2 |
| 06 | Implement and manage sign-in risk by using Microsoft Entra ID Protection or Conditional Access policies | 2 |
| 06 | Implement and manage multifactor authentication registration by using authentication methods and registration campaigns | 3 |
| 06 | Monitor, investigate and remediate risky users and risky sign-ins | 4 |
| 06 | Monitor, investigate, and remediate risky workload identities | 5 |
| 06 | Deploy Global Secure Access clients | 6 |
| 06 | Deploy and manage Microsoft Entra Private Access | 7 |
| 06 | Deploy and manage Microsoft Entra Internet Access | 8 |
| 06 | Deploy and manage the Microsoft traffic profile for Microsoft 365 | 9 |
Plan and implement workload identities (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 07 | Select appropriate identities for applications and Azure workloads, including managed identities, service principals, user accounts, and managed service accounts | 2 |
| 07 | Create managed identities | 3 |
| 07 | Assign a managed identity to an Azure resource | 3 |
| 07 | Use a managed identity assigned to an Azure resource to access other Azure resources | 4 |
| 07 | Plan and implement settings for enterprise applications, including application-level and tenant-level settings | 5 |
| 07 | Assign appropriate Microsoft Entra roles to users to manage enterprise applications | 6 |
| 07 | Design and implement integration for on-premises apps by using Microsoft Entra Application Proxy | 7 |
| 07 | Design and implement integration for software as a service (SaaS) apps | 8 |
| 07 | Assign, classify, and manage users, groups, and app roles for enterprise applications | 9 |
| 07 | Configure and manage user and admin consent | 10 |
| 07 | Create and manage application collections | 11 |
| 07 | Plan for app registrations | 12 |
| 07 | Create app registrations | 13 |
| 07 | Configure app authentication | 14 |
| 07 | Configure API permissions | 15 |
| 07 | Create app roles | 16 |
| 08 | Configure and analyze cloud discovery results by using Defender for Cloud Apps | 2 |
| 08 | Configure connected apps | 4 |
| 08 | Implement application-enforced restrictions | 5 |
| 08 | Configure Conditional Access app control | 6 |
| 08 | Create access and session policies in Defender for Cloud Apps | 7 |
| 08 | Implement and manage policies for OAuth apps | 8 |
| 08 | Manage the Cloud app catalog | 3 |
Plan and automate identity governance (20 à 25 %)#
| Ch. | Compétence mesurée (guide officiel, en anglais) | Section |
|---|---|---|
| 09 | Plan entitlements | 2.1 |
| 09 | Create and configure catalogs | 2.2 |
| 09 | Create and configure access packages | 2.3 |
| 09 | Manage access requests | 2.4 |
| 09 | Implement and manage terms of use (ToU) | 2.5 |
| 09 | Manage the lifecycle of external users | 2.6 |
| 09 | Configure and manage connected organizations | 2.7 |
| 09 | Plan for access reviews | 3.1 |
| 09 | Create and configure access reviews | 3.2 |
| 09 | Monitor access review activity | 3.3 |
| 09 | Manually respond to access review activity | 3.4 |
| 09 | Plan and manage Microsoft Entra roles in Microsoft Entra Privileged Identity Management (PIM), including settings and assignments | 4.1 |
| 09 | Plan and manage Azure resources in PIM, including settings and assignments | 4.2 |
| 09 | Plan and configure PIM for Groups | 4.3 |
| 09 | Manage the PIM request and approval process | 4.4 |
| 09 | Analyze PIM audit history and reports | 4.5 |
| 09 | Create and manage emergency access accounts | 4.6 |
| 10 | Review and analyze sign-in, audit, and provisioning logs by using the Microsoft Entra admin center | 2 |
| 10 | Configure diagnostic settings, including configuring destinations such as Log Analytics workspaces, storage accounts, and Azure Event Hubs | 3 |
| 10 | Monitor Microsoft Entra ID by using KQL queries in Log Analytics | 4 |
| 10 | Analyze Microsoft Entra ID by using workbooks and reporting | 5 |
| 10 | Monitor and improve the security posture by using Identity Secure Score | 6 |
Organisation du dossier#
SC-300/
├── README.md ce plan de révision
├── 01-…md à 10-…md un fichier par bloc de compétences
├── images/ les schémas exportés en PNG (affichés dans les chapitres)
├── DRAWIO/ les schémas sources, modifiables dans draw.io
└── outils/ les scripts qui génèrent les schémas (moteur de GenDoc)
Régénérer les schémas d'un chapitre : python outils/schemas_NN.py [noms…] depuis ce dossier (GenDoc doit être dans ..\..\GENERATEUR-PPT).
Méthode de révision conseillée#
- Relire d'abord SC-500 chapitre 01 (socle identité), puis les chapitres SC-300 dans l'ordre.
- Faire les labs conseillés dans un tenant de test (essai Microsoft Entra ID P2 ou Microsoft 365 E5 de développement), jamais sur le tenant de production.
- Répondre aux scénarios sans regarder la réponse, puis passer l'évaluation d'entraînement officielle.
- La veille de l'examen : relire les fiches à retenir et les tableaux de pièges.