Microsoft SC-300 Bundle

Application identities can be overprivileged even when their credentials are temporary or federated, which makes Reduce the app and resource grants to only the required operations appropriate when security finds that the application's service principal has unrelated directory-wide permissions; here the task is a code review finds a production service principal secret checked into source control, requiring Revoke the exposed credential and migrate to a managed or federated identity where feasible.

When an application unexpectedly receives a 403 after obtaining an identity token, Inspect the target API's access control and the token's intended audience is justified because an Entra identity token can be valid while the resource independently denies an ungranted action; here the issue is a code review finds a production service principal secret checked into source control, and Revoke the exposed credential and migrate to a managed or federated identity where feasible addresses that distinction.

Provision an independently governed user-assigned managed identity for supported resources concerns investigators require a stable identity for a multi-resource automation that is moved across approved compute pools, where a separate identity can be attached to successive eligible compute resources under the same access controls; the current scenario instead requires a code review finds a production service principal secret checked into source control, so Revoke the exposed credential and migrate to a managed or federated identity where feasible is a closer fit.

Provisioning synchronizes account lifecycle to the SaaS without manual user creation in that application, which makes Configure supported SCIM provisioning with mappings, scope and deprovisioning behavior appropriate when payroll accounts must be created and deactivated automatically when group assignments change; here the task is employees should sign into the payroll SaaS through an approved SAML-based corporate identity, requiring Configure SAML single sign-on on the enterprise application with matching identifiers and certificates.

Route the permission request through the authorized admin-consent review process concerns a new SaaS app requests tenant-wide consent for directory read permissions, where tenant-wide consent can expose data across users and needs deliberate approval of the requested scopes; the current scenario instead requires employees should sign into the payroll SaaS through an approved SAML-based corporate identity, so Configure SAML single sign-on on the enterprise application with matching identifiers and certificates is a closer fit.

The distinct mechanism for Require user assignment and assign the approved payroll group to the enterprise app is that application assignment restricts authorized users independently of successful tenant authentication; this handles only the payroll department should be able to launch the SaaS application rather than employees should sign into the payroll SaaS through an approved SAML-based corporate identity, so use Configure SAML single sign-on on the enterprise application with matching identifiers and certificates.

When payroll accounts must be created and deactivated automatically when group assignments change, Configure supported SCIM provisioning with mappings, scope and deprovisioning behavior is justified because provisioning synchronizes account lifecycle to the SaaS without manual user creation in that application; here the issue is only the payroll department should be able to launch the SaaS application, and Require user assignment and assign the approved payroll group to the enterprise app addresses that distinction.

Reconcile the enterprise app's SAML audience identifier with the service provider setting concerns payroll admins report an invalid-audience SAML error after the vendor changes the entity ID, where a mismatched SAML audience is a token validation problem, not an ordinary Entra password failure; the current scenario instead requires only the payroll department should be able to launch the SaaS application, so Require user assignment and assign the approved payroll group to the enterprise app is a closer fit.

The distinct mechanism for Map approved user attributes or app role/group provisioning into the supported SaaS model is that automatic app account updates depend on the target application's provisioning interface and mapping rules; this handles a team wants the same employee's SaaS role to update automatically when their department changes rather than only the payroll department should be able to launch the SaaS application, so use Require user assignment and assign the approved payroll group to the enterprise app.

The distinct mechanism for Decommission the app's access, provisioning and tokens under the approved retirement plan is that unused service principals and assignments can preserve unnecessary routes to data; this handles a former vendor's enterprise app is no longer used but retains active assignments rather than payroll accounts must be created and deactivated automatically when group assignments change, so use Configure supported SCIM provisioning with mappings, scope and deprovisioning behavior.

Although Configure SAML single sign-on on the enterprise application with matching identifiers and certificates fits employees should sign into the payroll SaaS through an approved SAML-based corporate identity (sAML integration depends on agreed entity IDs, endpoints, and issuer signing trust), it is not the necessary control for payroll accounts must be created and deactivated automatically when group assignments change. Select Configure supported SCIM provisioning with mappings, scope and deprovisioning behavior.

Change the relevant enterprise app assignment and SSO controls for access management would support the different situation where an engineer tries to delete the registration instead of adjusting the enterprise app's user assignment: the enterprise service principal is the runtime app instance; deletion of the developer registration is a different action; however it does not resolve payroll accounts must be created and deactivated automatically when group assignments change, which calls for Configure supported SCIM provisioning with mappings, scope and deprovisioning behavior.

Although Require user assignment and assign the approved payroll group to the enterprise app fits only the payroll department should be able to launch the SaaS application (application assignment restricts authorized users independently of successful tenant authentication), it is not the necessary control for payroll admins report an invalid-audience SAML error after the vendor changes the entity ID. Select Reconcile the enterprise app's SAML audience identifier with the service provider setting.

Validate Kerberos constrained delegation and service principal name requirements would support the different situation where external staff need seamless integrated Windows sign-in after Entra preauthentication: backend Windows SSO depends on correct Kerberos identity and delegation configuration; however it does not resolve payroll admins report an invalid-audience SAML error after the vendor changes the entity ID, which calls for Reconcile the enterprise app's SAML audience identifier with the service provider setting.

A maintained integration template reduces manual setup but still requires explicit validation, which makes Start from the supported enterprise gallery app and validate the vendor-specific claims appropriate when a vendor SaaS already provides an Entra gallery template for SAML; here the task is payroll admins report an invalid-audience SAML error after the vendor changes the entity ID, requiring Reconcile the enterprise app's SAML audience identifier with the service provider setting.

Although Rotate the signing certificate through coordinated identity provider and service provider configuration fits a migrated app's SAML certificate expires next week (both trust endpoints must agree on accepted signing credentials during certificate rollover), it is not the necessary control for an on-premises web app should be accessible remotely through Microsoft Entra preauthentication. Select Publish the supported app through Microsoft Entra application proxy with a healthy connector.

Configure supported Kerberos constrained delegation for single sign-on where appropriate would support the different situation where the app already trusts Windows integrated authentication after the proxy connector: application Proxy can translate identity to a supported on-premises Windows authentication path with proper delegation; however it does not resolve an on-premises web app should be accessible remotely through Microsoft Entra preauthentication, which calls for Publish the supported app through Microsoft Entra application proxy with a healthy connector.

SAML integration depends on agreed entity IDs, endpoints, and issuer signing trust, which makes Configure SAML single sign-on on the enterprise application with matching identifiers and certificates appropriate when employees should sign into the payroll SaaS through an approved SAML-based corporate identity; here the task is an on-premises web app should be accessible remotely through Microsoft Entra preauthentication, requiring Publish the supported app through Microsoft Entra application proxy with a healthy connector.

Integration health cannot be inferred from successful human sign-ins to unrelated apps, which makes Review provisioning status, logs, and cycle failures for the enterprise applications appropriate when the organization wants to check which app integrations have failing automatic provisioning; here the task is users are redirected to the proxy but receive backend connection failures, requiring Inspect connector health, network resolution and the internal application URL.

When the application proxy connector cannot resolve the internal service hostname, Repair connector-side DNS and backend network reachability is justified because a healthy Entra policy cannot compensate for missing internal DNS resolution; here the issue is users are redirected to the proxy but receive backend connection failures, and Inspect connector health, network resolution and the internal application URL addresses that distinction.

Publish the supported app through Microsoft Entra application proxy with a healthy connector concerns an on-premises web app should be accessible remotely through Microsoft Entra preauthentication, where application Proxy can provide secure remote access and preauthentication without publishing a generic internal endpoint; the current scenario instead requires users are redirected to the proxy but receive backend connection failures, so Inspect connector health, network resolution and the internal application URL is a closer fit.

Preauthentication success does not prove an on-premises connector can reach the backend server, which makes Inspect connector health, network resolution and the internal application URL appropriate when users are redirected to the proxy but receive backend connection failures; here the task is the app already trusts Windows integrated authentication after the proxy connector, requiring Configure supported Kerberos constrained delegation for single sign-on where appropriate.

When an on-premises web app should be accessible remotely through Microsoft Entra preauthentication, Publish the supported app through Microsoft Entra application proxy with a healthy connector is justified because application Proxy can provide secure remote access and preauthentication without publishing a generic internal endpoint; here the issue is the app already trusts Windows integrated authentication after the proxy connector, and Configure supported Kerberos constrained delegation for single sign-on where appropriate addresses that distinction.

Repair connector-side DNS and backend network reachability concerns the application proxy connector cannot resolve the internal service hostname, where a healthy Entra policy cannot compensate for missing internal DNS resolution; the current scenario instead requires the app already trusts Windows integrated authentication after the proxy connector, so Configure supported Kerberos constrained delegation for single sign-on where appropriate is a closer fit.

When users are redirected to the proxy but receive backend connection failures, Inspect connector health, network resolution and the internal application URL is justified because preauthentication success does not prove an on-premises connector can reach the backend server; here the issue is the project manager wants to expose the whole internal subnet to fix one application's access issue, and Scope the Application Proxy publishing to the specific supported web application addresses that distinction.

Configure supported Kerberos constrained delegation for single sign-on where appropriate concerns the app already trusts Windows integrated authentication after the proxy connector, where application Proxy can translate identity to a supported on-premises Windows authentication path with proper delegation; the current scenario instead requires the project manager wants to expose the whole internal subnet to fix one application's access issue, so Scope the Application Proxy publishing to the specific supported web application is a closer fit.

Although Repair connector-side DNS and backend network reachability fits the application proxy connector cannot resolve the internal service hostname (a healthy Entra policy cannot compensate for missing internal DNS resolution), it is not the necessary control for the project manager wants to expose the whole internal subnet to fix one application's access issue. Select Scope the Application Proxy publishing to the specific supported web application.

Configure the enterprise SSO integration using the vendor's supported OpenID Connect flow concerns the SaaS vendor supports OpenID Connect with redirect URI and client settings, where oIDC sign-in requires correct redirect endpoints, token audience, and issuer trust; the current scenario instead requires a new SaaS application has a supported gallery integration template, so Add the gallery enterprise application and configure the vendor's required SSO settings is a closer fit.

Although Require user assignment and assign the approved payroll group to the enterprise app fits only the payroll department should be able to launch the SaaS application (application assignment restricts authorized users independently of successful tenant authentication), it is not the necessary control for a new SaaS application has a supported gallery integration template. Select Add the gallery enterprise application and configure the vendor's required SSO settings.

Map approved user attributes or app role/group provisioning into the supported SaaS model would support the different situation where a team wants the same employee's SaaS role to update automatically when their department changes: automatic app account updates depend on the target application's provisioning interface and mapping rules; however it does not resolve a new SaaS application has a supported gallery integration template, which calls for Add the gallery enterprise application and configure the vendor's required SSO settings.

The distinct mechanism for Repair connector-side DNS and backend network reachability is that a healthy Entra policy cannot compensate for missing internal DNS resolution; this handles the application proxy connector cannot resolve the internal service hostname rather than a niche research application has no gallery listing but supports standards-based SAML SSO, so use Create a non-gallery enterprise application and configure its SAML trust settings.

Although Use Entra Application Proxy with a connector placed on the internal network fits an internal legacy application needs a reverse-access path without publishing its private DNS name (application Proxy provides app-specific remote connectivity while the backend stays on private infrastructure), it is not the necessary control for a niche research application has no gallery listing but supports standards-based SAML SSO. Select Create a non-gallery enterprise application and configure its SAML trust settings.

A maintained integration template reduces manual setup but still requires explicit validation, which makes Start from the supported enterprise gallery app and validate the vendor-specific claims appropriate when a vendor SaaS already provides an Entra gallery template for SAML; here the task is a niche research application has no gallery listing but supports standards-based SAML SSO, requiring Create a non-gallery enterprise application and configure its SAML trust settings.