SC-100: Microsoft Cybersecurity Architect
Module 2: Identity & Access Management
Study Guide | Exam Preparation
2.1 Microsoft Entra ID Overview
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access
management service. It's the backbone of identity in Microsoft's Zero Trust framework and is central
to the SC-100 exam.
Key Capabilities
● Single Sign-On (SSO) to thousands of SaaS and on-premises applications
● Multi-Factor Authentication (MFA) and passwordless authentication
● Conditional Access for adaptive, risk-based access control
● Identity Protection for automated detection and remediation of identity risks
● Privileged Identity Management (PIM) for JIT privileged access
● Entra ID Governance for lifecycle management and access reviews
📌 Exam tip: Entra ID P1 = Conditional Access, Hybrid Join, Group-based access. P2 = PIM,
Identity Protection, Entitlement Management.
2.2 Privileged Identity Management (PIM)
PIM is a service in Entra ID that enables you to manage, control, and monitor access to important
resources. It reduces the risk of privileged account abuse by requiring justification and approval for
elevated roles.
PIM Key Concepts
● Eligible Assignments – User can activate the role when needed, not permanently assigned
● Active Assignments – User has the role active at all times (use sparingly)
● Time-Bound Activation – Roles expire automatically after a set period (e.g., 1–8 hours)
● Approval Workflow – Require a designated approver before activation
● MFA on Activation – Require re-authentication when activating a privileged role
● Access Reviews – Periodic reviews to validate whether assignments are still needed
PIM supports both Entra ID roles (e.g., Global Admin, Security Admin) and Azure resource roles
(e.g., Owner, Contributor).
📌 Exam tip: Design questions often ask whether to use Eligible vs Active assignments. Eligible is
always preferred for privileged roles to reduce standing access.
2.3 Identity Governance
Entra ID Governance helps organizations ensure the right people have the right access to the right
resources. It automates identity lifecycle management and provides audit capabilities.
Core Governance Features
● Entitlement Management – Create access packages (bundles of resources) for
users/groups/guests
● Access Reviews – Periodically review and recertify access to groups, apps, and roles
● Lifecycle Workflows – Automate onboarding, offboarding, and role transitions
● Terms of Use – Require users to accept terms before accessing applications
Access Packages
Access packages bundle together role assignments, group memberships, and app access into a single
request. Users can self-request access or be assigned automatically. They expire based on policy,
enforcing time-bound access.
📌 Exam tip: For B2B/partner scenarios, Entitlement Management access packages are the preferred
approach over manually assigning guest users to individual resources.
2.4 Identity Protection
Microsoft Entra ID Protection uses machine learning to detect suspicious sign-in behaviors and
automate remediation. It feeds risk signals into Conditional Access policies.
Risk Types
● User Risk – Likelihood that a user identity is compromised (e.g., leaked credentials, unusual
activity)
● Sign-in Risk – Likelihood that a specific sign-in is not from the legitimate user (e.g., atypical
travel, anonymous IP)
Automated Remediation
● High sign-in risk → Block access or require MFA re-authentication
● High user risk → Require password change via self-service password reset
● Low/Medium risk → Allow access with MFA challenge
Identity Protection requires Entra ID P2. Risk detections can be viewed in the Identity Protection
dashboard and exported to Microsoft Sentinel for SIEM correlation.
📌 Exam tip: Identity Protection does NOT replace Conditional Access — it feeds signals INTO
Conditional Access. You need both for automated risk-based policies.
2.5 Hybrid Identity Design
Many enterprises have on-premises Active Directory (AD DS) alongside cloud workloads. Designing
hybrid identity correctly is critical for seamless SSO and consistent policy enforcement.
Hybrid Options
● Password Hash Synchronization (PHS) – Hashes of on-prem passwords synced to Entra ID;
simplest and most resilient
● Pass-Through Authentication (PTA) – Authentication passes to on-prem AD; no hash stored
in cloud
● AD FS – Full federation; most complex; supports smart card and custom claim rules
Microsoft Entra Connect
Entra Connect (formerly Azure AD Connect) synchronizes on-premises AD objects to Entra ID. Entra
Connect Cloud Sync is a lightweight alternative using agents instead of a full server install.
● Entra Connect: Best for complex filtering, custom attribute mapping, writeback features
● Entra Connect Cloud Sync: Best for multi-forest environments, simple sync, high availability
📌 Exam tip: PHS is recommended by Microsoft as the default hybrid auth method due to resilience —
authentication works even if on-prem AD is unavailable.