SC-300: Azure Active Directory & Identity Management

A learning roadmap created for the STYAVA.dev community. At STYAVA.dev, we build learning experiences that are simple, direct, and beginner-friendly. This guide brings together everything covered across all 4 days of the SC-300 training — explained in plain language, with links to explore more. Each day focuses on one core area of Microsoft Entra ID (Azure AD). Every point below includes a short explanation so learners understand why it matters.

CHAPTER 1

🆔 Identity: What It Actually Means

Identity is the digital name tag for users, apps, and devices. Without identity, nothing can log in or access resources.

🔐 Authentication: Proving Who You Are

This is the login step — username, password, OTP, biometrics. The system checks if you are genuine.

🔑 Authorization: What You Can Do After Login

Example: you may be allowed to view files but not edit them.

☁️ Azure AD = Cloud Identity

Azure AD (now called Microsoft Entra ID) doesn’t use:

* Domain controllers

* Group policies

* OUs

* FSMO roles

It is built for cloud apps, SaaS usage, and identity for modern environments.

🖥️ On-Prem AD DS = Traditional Identity

Uses SYSVOL, NTDS database, LDAP, and domain controllers.

Very different from Azure AD.

📘 Understanding SC-300 Exam Structure

Trainer covered retake rules, question types, and how Microsoft structures identity certifications.

📚 Explore More

CHAPTER 2

Setting Up On-Prem AD DS & Understanding Azure AD Tenant

🏗️ Setting Up a Domain Controller

The trainer created a Windows Server VM, installed AD DS, and promoted it to a DC (apple.com).

Purpose: show what “traditional identity” looks like.

👤 Creating Users (Example: “Eric”)

This showed how accounts are stored in NTDS database with attributes like SID, UPN, etc.

🗂️ Hierarchy in On-Prem AD

On-prem uses: Forests Domains OUs Group Policies

Designed for large, structured networks.

☁️ Azure AD Tenant = Auto-Created

When you create an Azure account, your Azure AD tenant appears automatically. You don’t install anything or manage domain controllers.

⚠️ Azure AD Doesn’t Support On-Prem Features

No GPO, no OUs, no FSMO roles — because it’s built for cloud-first identity.

📚 Explore More

CHAPTER 3

Role-Based Access Control (RBAC) & Permissions

💼 Azure AD Editions

Free, Microsoft 365, P1, and P2 — each adds more capabilities (especially security features in P1/P2).

🌐 Two Admin Portals

portal.azure.com → Full Azure management

aad.portal.azure.com → Identity-focused (Microsoft Entra Admin Center)

🛂 What RBAC Does

RBAC controls who can manage which Azure resources.

You give users the right level of access instead of full admin rights.

🧩 RBAC Scope Levels

Roles flow downward from the level you assign them:

* Management Group

* Subscription

* Resource Group

* Resource

* Higher level = more access.

👥 Real Demo

Trainer created users (Arjun, Messi) and resource groups (HR, Market, Sales) to show how access inheritance works.

📌 Key Lesson

Assigning access at subscription level impacts everything below it.

This is why STYAVA-style guidance always stresses Least Privilege Access.

📚 Explore More

CHAPTER 4

Hybrid Identity, Azure AD Connect, DNS, MFA & Conditional Access

🚫 You Can’t Just “Recreate” On-Prem Users in Azure

Because their SID won’t match.

A new identity = broken permissions.

🔄 Azure AD Connect is the Official Sync Tool

Connects on-prem AD DS with Azure AD.

It syncs:

* Users

* Passwords

* Attributes

* Groups

It does not replicate the full AD DS database.

🔁 Supported Auth Methods

Password Hash Sync (PHS) → Simple + secure

Pass-Through Authentication (PTA) → On-prem validation

Federation (AD FS) → Full control, complex setup

🌍 DNS Is Critical for Identity

DNS discovers domain controllers and handles authentication flows.

Azure DNS doesn’t act as AD-integrated DNS — it’s for cloud resources.

🛡️ MFA + Conditional Access = Core Cloud Security

Together they protect user accounts from risky logins, unfamiliar locations, compromised devices, and more.

📚 Explore More

Frequently asked questions

What is the SC-300 exam?

SC-300 is Microsoft's Identity and Access Administrator exam. It tests how you manage identities, authentication and access in Microsoft Entra ID (formerly Azure AD). This Styava.dev roadmap covers the core ideas in 4 chapters from our live training.

What does this SC-300 course cover?

Chapter 1 covers identity, authentication, authorization and the exam structure. Chapter 2 compares on-premises AD DS with an Azure AD tenant. Chapter 3 covers Azure RBAC and permissions. Chapter 4 covers hybrid identity, Azure AD Connect, DNS, MFA and Conditional Access.

Is Azure AD the same as Microsoft Entra ID?

Yes. Microsoft renamed Azure Active Directory to Microsoft Entra ID. The old name still appears in many tutorials and exam materials, so this page uses both.

What is the difference between authentication and authorization?

Authentication proves who you are, for example with a password, OTP or biometrics. Authorization decides what you can do after you sign in, such as viewing a file but not editing it.

How is Azure AD different from on-premises Active Directory (AD DS)?

Azure AD is a cloud identity service built for cloud apps and SaaS. It has no domain controllers, Group Policy, OUs or FSMO roles. On-premises AD DS uses domain controllers, SYSVOL, the NTDS database and LDAP.

Do I need prior experience to follow this course?

The roadmap is written for beginners and explains each idea in plain language. Basic familiarity with Azure or Windows Server helps, but each chapter starts from the fundamentals.