Practice exam only
€18.99
30 days · Labs not included.
View exam access →SC-300 · Hands-on practice
SC-300 Hands-on Labs — practise in a simulated Microsoft Entra admin center
Learn it. Practise it. Make it stick.
68 practical tasks. Familiar administration workflows, gradual hints and explanations. Independent simulation — no real tenant, device or cloud resources.
First five tasks are free, repeatable and have no expiry. No credit card required.
SC-300 Hands-on Labs
€14.99
All labs for this course. 30 days from payment confirmation.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your five free tasks.
SC-300 Practice Exam + Hands-on Labs
€29.99
Save €3.99. Exam and all labs each get 60 days.
One-time payment · No automatic renewal.
Purchases are temporarily unavailable. Enjoy your five free tasks.
Your learning path
LAB 01 · FREE
Delegate user support without tenant-wide access
Identity foundations · 12–15 min
Open lab →LAB 02 · FREE
Build and validate a dynamic Finance group
Identity foundations · 12–15 min
Open lab →LAB 03 · FREE
Limit guest invitations to an approved partner
External identities · 8–12 min
Open lab →LAB 04 · FREE
Bootstrap passwordless access with a scoped TAP
Authentication · 12–15 min
Open lab →LAB 05 · FREE
Pilot MFA without enforcing an untested policy
Conditional Access · 15–18 min
Open lab →LAB 06 · LOCKED
Onboard an analyst and repair a licensing prerequisite
Tenant and identity operations · 15–20 min
Included with full SC-300 lab access
LAB 07 · LOCKED
Create a custom role with only the required permissions
Tenant and identity operations · 12–15 min
Included with full SC-300 lab access
LAB 08 · LOCKED
Prepare a verified domain and branded sign-in experience
Tenant and identity operations · 18–22 min
Included with full SC-300 lab access
LAB 09 · LOCKED
Restrict self-service group creation and device registration
Tenant and identity operations · 15–18 min
Included with full SC-300 lab access
LAB 10 · LOCKED
Import a new team without changing existing identities
Tenant and identity operations · 18–22 min
Included with full SC-300 lab access
LAB 11 · LOCKED
Delegate custom security attributes separately from user administration
Tenant and identity operations · 18–22 min
Included with full SC-300 lab access
LAB 12 · LOCKED
Invite a partner team and safely offboard a departing guest
External identities · 20–25 min
Included with full SC-300 lab access
LAB 13 · LOCKED
Trust a partner MFA claim without opening every application
External identities · 18–22 min
Included with full SC-300 lab access
LAB 14 · LOCKED
Scope cross-tenant synchronization and diagnose provisioning
External and hybrid identities · 22–28 min
Included with full SC-300 lab access
LAB 15 · LOCKED
Configure federation for an external partner domain
External and hybrid identities · 18–22 min
Included with full SC-300 lab access
LAB 16 · LOCKED
Configure Connect Sync with a controlled synchronization boundary
External and hybrid identities · 20–25 min
Included with full SC-300 lab access
LAB 17 · LOCKED
Stage Cloud Sync with a healthy provisioning agent
External and hybrid identities · 20–25 min
Included with full SC-300 lab access
LAB 18 · LOCKED
Migrate federation in stages and investigate hybrid sign-in health
External and hybrid identities · 20–25 min
Included with full SC-300 lab access
LAB 19 · LOCKED
Enable SSPR for a pilot and verify writeback prerequisites
Authentication and recovery · 18–22 min
Included with full SC-300 lab access
LAB 20 · LOCKED
Roll out Authenticator using a targeted registration campaign
Authentication and recovery · 18–22 min
Included with full SC-300 lab access
LAB 21 · LOCKED
Restrict passkey registration to the approved pilot
Authentication and recovery · 20–25 min
Included with full SC-300 lab access
LAB 22 · LOCKED
Configure certificate authentication with strong user binding
Authentication and recovery · 25–30 min
Included with full SC-300 lab access
LAB 23 · LOCKED
Prepare Windows Hello for Business cloud Kerberos trust
Authentication and recovery · 25–30 min
Included with full SC-300 lab access
LAB 24 · LOCKED
Roll out password protection from audit to enforcement
Authentication and recovery · 20–25 min
Included with full SC-300 lab access
LAB 25 · LOCKED
Contain a compromised cloud account without deleting it
Authentication and recovery · 20–25 min
Included with full SC-300 lab access
LAB 26 · LOCKED
Diagnose a block with What If and report-only evidence
Conditional Access · 20–25 min
Included with full SC-300 lab access
LAB 27 · LOCKED
Pilot compliant-device access without an MFA escape route
Conditional Access · 20–25 min
Included with full SC-300 lab access
LAB 28 · LOCKED
Set session boundaries without confusing them with token expiry
Conditional Access · 18–22 min
Included with full SC-300 lab access
LAB 29 · LOCKED
Protect policy changes with authentication context and step-up
Conditional Access · 22–28 min
Included with full SC-300 lab access
LAB 30 · LOCKED
Adapt a policy template and investigate continuous access evaluation
Conditional Access · 22–28 min
Included with full SC-300 lab access
LAB 31 · LOCKED
Investigate user risk and sign-in risk before remediation
Identity Protection · 25–30 min
Included with full SC-300 lab access
LAB 32 · LOCKED
Contain a risky workload identity without user-only controls
Workload identities · 22–28 min
Included with full SC-300 lab access
LAB 33 · LOCKED
Publish a segmented private application for a pilot
Global Secure Access · 22–28 min
Included with full SC-300 lab access
LAB 34 · LOCKED
Pilot Internet and Microsoft 365 traffic forwarding
Global Secure Access · 20–25 min
Included with full SC-300 lab access
LAB 35 · LOCKED
Choose and assign a managed identity for an Azure workload
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 36 · LOCKED
Grant a managed identity least-privilege access to Key Vault
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 37 · LOCKED
Control enterprise application assignments and delegated administration
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 38 · LOCKED
Configure SAML single sign-on and validate application claims
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 39 · LOCKED
Publish an internal application with Application Proxy
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 40 · LOCKED
Review an admin consent request without granting unnecessary permissions
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 41 · LOCKED
Register an application with the correct platform and redirect URI
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 42 · LOCKED
Configure API permissions and app roles for the correct identity
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 43 · LOCKED
Assess discovered cloud apps and connect an approved service
Applications and workload identities · 20–25 min
Included with full SC-300 lab access
LAB 44 · LOCKED
Restrict an unmanaged browser session with app controls
Applications and workload identities · 25–30 min
Included with full SC-300 lab access
LAB 45 · LOCKED
Build an access package for a connected partner organization
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 46 · LOCKED
Process access requests with approval and expiry safeguards
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 47 · LOCKED
Require terms of use and inspect acceptance records
Identity governance · 25–30 min
Included with full SC-300 lab access
LAB 48 · LOCKED
Run an access review and apply reviewer decisions safely
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 49 · LOCKED
Make an Entra role eligible and approve time-bound activation
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 50 · LOCKED
Manage privileged Azure roles and time-bound group membership
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 51 · LOCKED
Prepare emergency access accounts and monitoring safeguards
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 52 · LOCKED
Correlate sign-in, audit and provisioning events
Identity governance · 25–30 min
Included with full SC-300 lab access
LAB 53 · LOCKED
Route identity logs to Log Analytics, storage and Event Hubs
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 54 · LOCKED
Use workbooks and Identity Secure Score to prioritize improvements
Identity governance · 25–30 min
Included with full SC-300 lab access
LAB 55 · LOCKED
Resolve a new starter access failure without adding an administrator role
Challenge · 30–35 min
Included with full SC-300 lab access
LAB 56 · LOCKED
Restore partner access while retaining cross-tenant safeguards
Challenge · 30–35 min
Included with full SC-300 lab access
LAB 57 · LOCKED
Repair a hybrid synchronization failure without changing cloud-owned data
Challenge · 30–35 min
Included with full SC-300 lab access
LAB 58 · LOCKED
Recover a passwordless pilot from conflicting authentication policies
Challenge · 30–35 min
Included with full SC-300 lab access
LAB 59 · LOCKED
Repair application sign-in and authorization without broad consent
Challenge · 30–35 min
Included with full SC-300 lab access
LAB 60 · LOCKED
Close a privileged-access incident and demonstrate the audit trail
Challenge · 35–40 min
Included with full SC-300 lab access
LAB 61 · LOCKED
Troubleshoot Seamless SSO and Connect Health alerts
External and hybrid identities · 30–35 min
Included with full SC-300 lab access
LAB 62 · LOCKED
Investigate and govern OAuth applications
Applications and workload identities · 30–35 min
Included with full SC-300 lab access
LAB 63 · LOCKED
Investigate a synthetic identity incident with KQL
Identity governance · 30–35 min
Included with full SC-300 lab access
LAB 64 · LOCKED
Automate user provisioning to a SaaS application
Applications and workload identities · 30–35 min
Included with full SC-300 lab access
LAB 65 · LOCKED
Publish an on-premises app with Kerberos constrained delegation SSO
Applications and workload identities · 30–35 min
Included with full SC-300 lab access
LAB 66 · LOCKED
Replace expiring application secrets with federated credentials
Applications and workload identities · 25–30 min
Included with full SC-300 lab access
LAB 67 · LOCKED
Onboard a partner organization end to end
Challenge · 40–45 min
Included with full SC-300 lab access
LAB 68 · LOCKED
Secure a new line-of-business application end to end
Challenge · 40–45 min
Included with full SC-300 lab access
SC-300 hands-on labs — questions
- Does SC-300 have labs, and can I practise them without a tenant?
- Yes. ExamIT Lab gives you 68 guided SC-300 labs in a simulated Microsoft Entra admin center. Nothing is deployed to a real Microsoft tenant, subscription or device, so there is nothing to set up, nothing to pay Microsoft for, and nothing you can break.
- Are the SC-300 labs free?
- The first 5 labs in the learning order are free, repeatable and never expire — no credit card and no sign-up required to start. The full course of 68 labs is a one-time purchase with no subscription.
- What does a SC-300 lab look like?
- Each lab opens a realistic simulation of the Microsoft Entra admin center — identities, authentication methods, Conditional Access, enterprise applications and identity governance. You get a task brief, a guided or independent mode, progressive hints and a "Check configuration" button that grades the actual end state you left behind — not just the buttons you clicked.
- Do the labs cover the current SC-300 exam outline?
- The labs are mapped to the objectives in Microsoft's current SC-300 study guide, and we re-audit the mapping when Microsoft updates the skills measured. Combine them with the SC-300 practice test on ExamIT Lab for full coverage.
- How is this different from a Microsoft Learn sandbox or a trial tenant?
- A trial tenant gives you a blank environment and no feedback. These labs give you a pre-built scenario with fictional users, devices and policies, a clear goal, and automatic checking of your result — so you practise the exact administration workflows the SC-300 exam expects, in minutes, not hours of setup.
Access is per course. Sign in for account progress. After paid access expires, your saved progress is retained and the first five tasks remain free.