SC-300: Azure Active Directory & Identity Management
A learning roadmap created for the STYAVA.dev community. At STYAVA.dev, we build learning experiences that are simple, direct, and beginner-friendly. This guide brings together everything covered across all 4 days of the SC-300 training — explained in plain language, with links to explore more. Each day focuses on one core area of Microsoft Entra ID (Azure AD). Every point below includes a short explanation so learners understand why it matters.
🆔 Identity: What It Actually Means
Identity is the digital name tag for users, apps, and devices. Without identity, nothing can log in or access resources.
🔐 Authentication: Proving Who You Are
This is the login step — username, password, OTP, biometrics. The system checks if you are genuine.
🔑 Authorization: What You Can Do After Login
Example: you may be allowed to view files but not edit them.
☁️ Azure AD = Cloud Identity
Azure AD (now called Microsoft Entra ID) doesn’t use:
* Domain controllers
* Group policies
* OUs
* FSMO roles
It is built for cloud apps, SaaS usage, and identity for modern environments.
🖥️ On-Prem AD DS = Traditional Identity
Uses SYSVOL, NTDS database, LDAP, and domain controllers.
Very different from Azure AD.
📘 Understanding SC-300 Exam Structure
Trainer covered retake rules, question types, and how Microsoft structures identity certifications.
Setting Up On-Prem AD DS & Understanding Azure AD Tenant
🏗️ Setting Up a Domain Controller
The trainer created a Windows Server VM, installed AD DS, and promoted it to a DC (apple.com).
Purpose: show what “traditional identity” looks like.
👤 Creating Users (Example: “Eric”)
This showed how accounts are stored in NTDS database with attributes like SID, UPN, etc.
🗂️ Hierarchy in On-Prem AD
On-prem uses: Forests Domains OUs Group Policies
Designed for large, structured networks.
☁️ Azure AD Tenant = Auto-Created
When you create an Azure account, your Azure AD tenant appears automatically. You don’t install anything or manage domain controllers.
⚠️ Azure AD Doesn’t Support On-Prem Features
No GPO, no OUs, no FSMO roles — because it’s built for cloud-first identity.
Role-Based Access Control (RBAC) & Permissions
💼 Azure AD Editions
Free, Microsoft 365, P1, and P2 — each adds more capabilities (especially security features in P1/P2).
🌐 Two Admin Portals
portal.azure.com → Full Azure management
aad.portal.azure.com → Identity-focused (Microsoft Entra Admin Center)
🛂 What RBAC Does
RBAC controls who can manage which Azure resources.
You give users the right level of access instead of full admin rights.
🧩 RBAC Scope Levels
Roles flow downward from the level you assign them:
* Management Group
* Subscription
* Resource Group
* Resource
* Higher level = more access.
👥 Real Demo
Trainer created users (Arjun, Messi) and resource groups (HR, Market, Sales) to show how access inheritance works.
📌 Key Lesson
Assigning access at subscription level impacts everything below it.
This is why STYAVA-style guidance always stresses Least Privilege Access.
Hybrid Identity, Azure AD Connect, DNS, MFA & Conditional Access
🚫 You Can’t Just “Recreate” On-Prem Users in Azure
Because their SID won’t match.
A new identity = broken permissions.
🔄 Azure AD Connect is the Official Sync Tool
Connects on-prem AD DS with Azure AD.
It syncs:
* Users
* Passwords
* Attributes
* Groups
It does not replicate the full AD DS database.
🔁 Supported Auth Methods
Password Hash Sync (PHS) → Simple + secure
Pass-Through Authentication (PTA) → On-prem validation
Federation (AD FS) → Full control, complex setup
🌍 DNS Is Critical for Identity
DNS discovers domain controllers and handles authentication flows.
Azure DNS doesn’t act as AD-integrated DNS — it’s for cloud resources.
🛡️ MFA + Conditional Access = Core Cloud Security
Together they protect user accounts from risky logins, unfamiliar locations, compromised devices, and more.