Microsoft SC-300 Bundle

Use a supported staging-mode architecture for the standby server and governed failover concerns the team needs to prove a second Connect Sync server will not concurrently export conflicting changes, where staging mode permits synchronization preparation without simultaneous authoritative export from two active engines; the current scenario instead requires a directory engineer proposes modifying the authoritative anchor for existing users during a routine migration, so Retain or carefully migrate the source anchor following supported matching procedures is a closer fit.

The distinct mechanism for Apply supported organizational-unit scoping and verify the resulting object population is that sync scoping controls which on-premises objects are provisioned instead of deleting accounts after arrival; this handles a directory migration must exclude one test OU from cloud synchronization rather than a directory engineer proposes modifying the authoritative anchor for existing users during a routine migration, so use Retain or carefully migrate the source anchor following supported matching procedures.

Although Reconcile the disabled account state and revoke active sessions where required fits a source AD account was disabled but still has an active Entra session (synchronization of account status does not guarantee all already-issued tokens disappear instantly), it is not the necessary control for a directory engineer proposes modifying the authoritative anchor for existing users during a routine migration. Select Retain or carefully migrate the source anchor following supported matching procedures.

Update the authoritative on-premises value when that attribute is mastered in AD concerns an administrator manually edits a synchronized cloud attribute and sees the value revert, where synchronization overwrites cloud-side edits to fields owned by the on-premises source; the current scenario instead requires the compliance team needs to trace attribute changes from AD into the cloud directory, so Correlate Connect Sync run history with directory audit and source attribute evidence is a closer fit.

The distinct mechanism for Retain or carefully migrate the source anchor following supported matching procedures is that changing the identity linkage casually can result in duplicate or disconnected cloud users; this handles a directory engineer proposes modifying the authoritative anchor for existing users during a routine migration rather than the compliance team needs to trace attribute changes from AD into the cloud directory, so use Correlate Connect Sync run history with directory audit and source attribute evidence.

Although Use a supported staging-mode architecture for the standby server and governed failover fits the team needs to prove a second Connect Sync server will not concurrently export conflicting changes (staging mode permits synchronization preparation without simultaneous authoritative export from two active engines), it is not the necessary control for the compliance team needs to trace attribute changes from AD into the cloud directory. Select Correlate Connect Sync run history with directory audit and source attribute evidence.

The distinct mechanism for Retain or carefully migrate the source anchor following supported matching procedures is that changing the identity linkage casually can result in duplicate or disconnected cloud users; this handles a directory engineer proposes modifying the authoritative anchor for existing users during a routine migration rather than a source AD account was disabled but still has an active Entra session, so use Reconcile the disabled account state and revoke active sessions where required.

Although Troubleshoot identity matching and source link rather than duplicate user provisioning fits an engineer tries to create matching cloud users while the original synchronized accounts still exist (parallel manual accounts can fragment entitlements and undermine a stable hybrid identity), it is not the necessary control for a source AD account was disabled but still has an active Entra session. Select Reconcile the disabled account state and revoke active sessions where required.

Correlate Connect Sync run history with directory audit and source attribute evidence would support the different situation where the compliance team needs to trace attribute changes from AD into the cloud directory: troubleshooting must establish whether source extraction, transform, or destination export changed a field; however it does not resolve a source AD account was disabled but still has an active Entra session, which calls for Reconcile the disabled account state and revoke active sessions where required.

Although Inspect Microsoft Entra Connect Health and password synchronization status fits the team wants to confirm whether password hash sync is healthy after a connector maintenance window (monitoring provides evidence of timely cloud hash propagation rather than assuming all jobs resumed), it is not the necessary control for the final migration must not leave a domain set to federation after AD FS is removed. Select Convert the domain to an approved managed authentication configuration after testing.

Check source enablement state propagation and effective sign-in settings would support the different situation where authentication succeeds on-premises but cloud users cannot sign in after an account disablement: account-enabled state and synchronization timing can explain divergence between local and cloud sessions; however it does not resolve the final migration must not leave a domain set to federation after AD FS is removed, which calls for Convert the domain to an approved managed authentication configuration after testing.

When a business application has custom AD FS token rules that may not translate automatically, Inventory the application's claims and reimplement them in a supported replacement integration is justified because complex relying-party transformations require deliberate migration rather than a simple DNS change; here the issue is the final migration must not leave a domain set to federation after AD FS is removed, and Convert the domain to an approved managed authentication configuration after testing addresses that distinction.

Inventory the application's claims and reimplement them in a supported replacement integration would support the different situation where a business application has custom AD FS token rules that may not translate automatically: complex relying-party transformations require deliberate migration rather than a simple DNS change; however it does not resolve the team wants to confirm whether password hash sync is healthy after a connector maintenance window, which calls for Inspect Microsoft Entra Connect Health and password synchronization status.

When the final migration must not leave a domain set to federation after AD FS is removed, Convert the domain to an approved managed authentication configuration after testing is justified because domain authentication mode must match the available sign-in infrastructure; here the issue is the team wants to confirm whether password hash sync is healthy after a connector maintenance window, and Inspect Microsoft Entra Connect Health and password synchronization status addresses that distinction.

Enable password hash synchronization and verify the authorized sign-in method concerns the security team requires cloud password authentication based on a synchronized password hash, where password hash synchronization enables Entra cloud authentication without routing every sign-in to local domain controllers; the current scenario instead requires the team wants to confirm whether password hash sync is healthy after a connector maintenance window, so Inspect Microsoft Entra Connect Health and password synchronization status is a closer fit.

Monitoring provides evidence of timely cloud hash propagation rather than assuming all jobs resumed, which makes Inspect Microsoft Entra Connect Health and password synchronization status appropriate when the team wants to confirm whether password hash sync is healthy after a connector maintenance window; here the task is a business application has custom AD FS token rules that may not translate automatically, requiring Inventory the application's claims and reimplement them in a supported replacement integration.

When the final migration must not leave a domain set to federation after AD FS is removed, Convert the domain to an approved managed authentication configuration after testing is justified because domain authentication mode must match the available sign-in infrastructure; here the issue is a business application has custom AD FS token rules that may not translate automatically, and Inventory the application's claims and reimplement them in a supported replacement integration addresses that distinction.

Compare feature support requirements before selecting Cloud Sync for the migration concerns an administrator assumes Cloud Sync automatically covers every Connect Sync writeback and hybrid feature, where the two sync products are not interchangeable for all hybrid scenarios or feature dependencies; the current scenario instead requires a business application has custom AD FS token rules that may not translate automatically, so Inventory the application's claims and reimplement them in a supported replacement integration is a closer fit.

When an administrator expects a TAP to work for an external B2B guest account from another organization, Use the guest's home-tenant authentication method and configured cross-tenant trust rather than issuing an unsupported external guest TAP is justified because a resource tenant cannot issue its ordinary TAP to an external guest principal; home authentication and trust must be used; here the issue is new employees need a time-limited method to bootstrap FIDO2 passkeys without a permanent shared password, and Enable and issue a scoped Temporary Access Pass under the authentication methods policy addresses that distinction.

The distinct mechanism for Provision separate authenticated user-bound credentials under approved enrollment rules is that shared credentials destroy individual accountability and create avoidable compromise and audit risk; this handles the firm proposes using one shared FIDO2 key for several named employees rather than new employees need a time-limited method to bootstrap FIDO2 passkeys without a permanent shared password, so use Enable and issue a scoped Temporary Access Pass under the authentication methods policy.

Although Configure allowed passkey or certificate-based methods and require an appropriate authentication strength fits administrators handling patient access must use a phishing-resistant sign-in method (authentication strengths can enforce phishing-resistant method combinations beyond a generic MFA requirement), it is not the necessary control for new employees need a time-limited method to bootstrap FIDO2 passkeys without a permanent shared password. Select Enable and issue a scoped Temporary Access Pass under the authentication methods policy.

The distinct mechanism for Use the guest's home-tenant authentication method and configured cross-tenant trust rather than issuing an unsupported external guest TAP is that a resource tenant cannot issue its ordinary TAP to an external guest principal; home authentication and trust must be used; this handles an administrator expects a TAP to work for an external B2B guest account from another organization rather than administrators handling patient access must use a phishing-resistant sign-in method, so use Configure allowed passkey or certificate-based methods and require an appropriate authentication strength.

Although Verify the user is in the TAP method policy scope and the pass remains valid fits a newly created TAP fails for the user despite appearing in the admin center (merely creating a TAP does not enable sign-in if authentication-method policy eligibility excludes the user), it is not the necessary control for administrators handling patient access must use a phishing-resistant sign-in method. Select Configure allowed passkey or certificate-based methods and require an appropriate authentication strength.

Require a FIDO2 or other supported phishing-resistant method for the targeted application would support the different situation where a legacy sign-in insists that a phone number is a sufficient phishing-resistant factor: telecom-based factors are not equivalent to cryptographic origin-bound authentication; however it does not resolve administrators handling patient access must use a phishing-resistant sign-in method, which calls for Configure allowed passkey or certificate-based methods and require an appropriate authentication strength.

Although Enable and issue a scoped Temporary Access Pass under the authentication methods policy fits new employees need a time-limited method to bootstrap FIDO2 passkeys without a permanent shared password (a TAP provides time-limited enrollment access and can be constrained for single use, supporting secure first method registration), it is not the necessary control for an administrator expects a TAP to work for an external B2B guest account from another organization. Select Use the guest's home-tenant authentication method and configured cross-tenant trust rather than issuing an unsupported external guest TAP.

Verify the user is in the TAP method policy scope and the pass remains valid would support the different situation where a newly created TAP fails for the user despite appearing in the admin center: merely creating a TAP does not enable sign-in if authentication-method policy eligibility excludes the user; however it does not resolve an administrator expects a TAP to work for an external B2B guest account from another organization, which calls for Use the guest's home-tenant authentication method and configured cross-tenant trust rather than issuing an unsupported external guest TAP.

Account disablement blocks new authentication, while session revocation addresses some already-established access paths, which makes Disable the account and revoke active sign-in sessions through supported controls appropriate when the department wants to stop a departing administrator from using an already-issued refresh session; here the task is an administrator expects a TAP to work for an external B2B guest account from another organization, requiring Use the guest's home-tenant authentication method and configured cross-tenant trust rather than issuing an unsupported external guest TAP.

Enable and issue a scoped Temporary Access Pass under the authentication methods policy would support the different situation where new employees need a time-limited method to bootstrap FIDO2 passkeys without a permanent shared password: a TAP provides time-limited enrollment access and can be constrained for single use, supporting secure first method registration; however it does not resolve a newly created TAP fails for the user despite appearing in the admin center, which calls for Verify the user is in the TAP method policy scope and the pass remains valid.

Authentication strengths can enforce phishing-resistant method combinations beyond a generic MFA requirement, which makes Configure allowed passkey or certificate-based methods and require an appropriate authentication strength appropriate when administrators handling patient access must use a phishing-resistant sign-in method; here the task is a newly created TAP fails for the user despite appearing in the admin center, requiring Verify the user is in the TAP method policy scope and the pass remains valid.

When the organization wants to require Authenticator rather than old voice call MFA for this workforce, Restrict allowed authentication methods to the supported Authenticator policy population is justified because authentication-method policy scope governs which user verification methods can be registered or used; here the issue is a newly created TAP fails for the user despite appearing in the admin center, and Verify the user is in the TAP method policy scope and the pass remains valid addresses that distinction.

Deploy Windows Hello for Business according to the supported tenant and device prerequisites would support the different situation where staff want passwordless Windows sign-in with device-associated credentials: windows Hello for Business uses device-bound asymmetric credentials rather than storing the plain account password; however it does not resolve staff must receive strong push approvals instead of relying on easily intercepted SMS verification, which calls for Enable the appropriate Microsoft Authenticator method and enforce supported number matching.

Service workloads should not be forced through human push approvals when an application identity can authenticate noninteractively, which makes Replace the interactive user dependency with a supported workload identity design appropriate when a legacy service account depends on an unsupported interactive authenticator prompt; here the task is staff must receive strong push approvals instead of relying on easily intercepted SMS verification, requiring Enable the appropriate Microsoft Authenticator method and enforce supported number matching.

When administrators propose using Windows Hello to authenticate a headless background service, Use an appropriate workload identity for the noninteractive service instead is justified because hello's interactive device-bound user sign-in is not a substitute for application authentication; here the issue is staff must receive strong push approvals instead of relying on easily intercepted SMS verification, and Enable the appropriate Microsoft Authenticator method and enforce supported number matching addresses that distinction.