What's changed: Created SC-300 Chapter 1 (Domain 1 first-half: tenant config/built-in-custom roles/effective permissions/administrative units; users-groups (assigned/dynamic)/group-based assignment/device join-registration/licenses; custom security attributes/ABAC/bulk operations/Microsoft Graph PowerShell).
1.3Custom security attributes and bulk operations
Understand classifying objects with custom security attributes (the basis for attribute-based access control) and bulk operations via the Microsoft Entra admin center and PowerShell (Microsoft Graph PowerShell).
At scale, "classification" and "automation" pay off. Master custom security attributes (metadata on objects) and bulk operations/scripting to handle repetitive tasks.
1.3.1Custom security attributes and ABAC
Custom security attributes classify users and apps (service principals) with org-defined key/values (e.g., Project=Apollo, Sensitivity=High). They form the basis of attribute-based access control (ABAC)—for example, conditioning access so only principals with a given attribute can reach specific Azure storage. Defining/assigning attributes requires dedicated roles (Attribute Definition/Assignment Administrator), separated from general admins.
1.3.2Bulk operations and PowerShell
For many users/groups, use bulk operations. The Microsoft Entra admin center supports CSV-based bulk create/delete/invite. For automation and repetition, script with Microsoft Graph PowerShell (successor to the older AzureAD/MSOnline modules) to update attributes or assign licenses programmatically. "Hundreds at once" and "the same task on a schedule" are met by scripting.
Cues: "tag objects with org classification and condition on attributes" = custom security attributes (ABAC). "bulk hundreds via CSV" = admin center bulk operations. "automation/repetition/programmatic" = Microsoft Graph PowerShell. Attribute define/assign uses dedicated roles.
Watch the mix-ups: (1) Custom security attributes (ABAC classification) differ from extension attributes/directory extensions. (2) Defining/assigning attributes needs dedicated roles—even a Global Administrator cannot assign by default. (3) The old AzureAD/MSOnline modules are deprecated—use Microsoft Graph PowerShell.
1.3.3Section summary
- Custom security attributes = classify objects with org key/values as the basis for ABAC; define/assign via dedicated roles
- Bulk operations = admin center CSV; automation/repetition via Microsoft Graph PowerShell scripting
- The old AzureAD/MSOnline modules are deprecated—use Microsoft Graph PowerShell
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to tag users/apps with org classification (e.g., Sensitivity=High) and condition Azure resource access on that attribute. Which is best?
Q2. You want to create hundreds of new-hire accounts at once. What is most appropriate in the admin center?
Q3. You want to automate attribute updates and license assignment with a scheduled script. Which is best?
Q4. Which is true about defining/assigning custom security attributes?
Q5. What is the best reason to use Microsoft Graph PowerShell?