What's changed: Created SC-300 Chapter 1 (Domain 1 first-half: tenant config/built-in-custom roles/effective permissions/administrative units; users-groups (assigned/dynamic)/group-based assignment/device join-registration/licenses; custom security attributes/ABAC/bulk operations/Microsoft Graph PowerShell).
1.1Configuring the Entra tenant, roles, and administrative units
Understand configuring a Microsoft Entra tenant (tenant/user/group/device settings, domains, branding), built-in/custom Entra roles and evaluating effective permissions, and delegating administrative scope with administrative units.
The identity admin starts by laying the Microsoft Entra tenant foundation: tenant-wide settings and who can manage what (roles and scope). The key is delegating as needed while preserving least privilege.
1.1.1Tenant configuration and domains
Use tenant properties and user/group/device settings to control default behaviors such as external sharing and whether users can register apps. Add and verify your organization’s custom domain (e.g., contoso.com) so it shares the identity foundation with Microsoft 365. Apply Company branding (logo/background on the sign-in screen) to improve recognizability against phishing. These are tenant-wide foundation settings.
1.1.2Built-in/custom roles and effective permissions
Grant admin rights via Entra roles. Choose least-privilege built-in roles (User Administrator, Authentication Administrator, etc.) that fit the job, and avoid routine use of Global Administrator. If no built-in role matches the needed permission set, define a custom role. Verify what a user can actually do by evaluating effective permissions. The principle: pick the least role required for the job, not the most powerful.
1.1.3Delegating scope with administrative units
In large organizations you often need to "let someone manage only a department/region’s users." Administrative units (AUs) scope a role’s application to a subset (specific users/groups/devices). Example: grant regional IT a Password Administrator role only over users in that region’s AU. The difference from a tenant-wide role is that scope is narrowed to the AU—reconciling delegation with least privilege.
Cues: "let someone manage only a department/region’s users" = administrative units (AU) + scoped role assignment. "least privilege for the job" = the right built-in role (custom role if none fits). "what a user can actually do" = evaluate effective permissions. Avoid routine Global Administrator use.
Watch the mix-ups: (1) Entra roles (directory admin rights) and Azure RBAC roles (Azure resource permissions) are separate systems. (2) Administrative units narrow a role’s scope—they do not grant permissions by themselves (a scoped assignment is needed). (3) Limit Global Administrator to fewest people + PIM/break-glass.
1.1.4Section summary
- Tenant config = tenant/user/group/device settings, custom domains, Company branding as the foundation
- Entra roles least-privilege built-in (custom if none); verify with effective permissions; do not routinely use Global Administrator
- Administrative units (AU) scope roles to a department/region subset, reconciling delegation and least privilege
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want regional IT to reset passwords only for that region’s users, not others. Which is best?
Q2. No built-in role exactly matches the needed permission set, and you want to keep least privilege. Which is best?
Q3. You want to verify whether a user can perform a specific action based on assigned roles. Which is best?
Q4. Which correctly states the relationship between Entra roles and Azure RBAC roles?
Q5. You want your org logo/background on the sign-in screen to improve recognizability against phishing. Which is best?