Identity and Access Administrator study guide

Learn it in this order

Identity work has a natural sequence: get the objects right, then decide how people prove who they are, then decide what they may reach, then govern how that changes over time. Learning it in that order means each block explains the next.

• Week 1. The tenant and its objects: users, groups, administrative units, roles, and how membership can be dynamic. Boring and it underpins everything.
• Weeks 2 to 3. Authentication and access. Methods, strength, registration, self-service reset, and Conditional Access until you can predict what a given policy does to a given sign-in.
• Week 4. Identity protection and risk: what raises risk, what a policy does about it, and the difference between acting on the sign-in and acting on the account.
• Week 5. Workload identities: managed identities, service principals, app registrations, consent and permissions.
• Weeks 6 to 7. Governance: entitlement management, access reviews, and privileged access. Then practice tests, and back to whichever area scored worst.

Conditional Access is the spine of this exam

More questions turn on Conditional Access than on any other single feature, and they are rarely about how to create a policy. They are about what happens when several apply, what a control actually requires, and what a person experiences when one blocks them.

• Know the difference between a grant control and a session control, and which problems each solves.
• Be able to say what happens when two policies target the same sign-in. The strictest requirement wins, and a block beats everything.
• Understand exclusions properly, especially the emergency accounts that must sit outside every policy.
• Know what report-only mode does and does not tell you, since it is the safe way to deploy and appears often.
• Learn where device state comes from, because a policy requiring a compliant device depends on something outside Conditional Access.

Where people lose marks

The traps here are mostly about which mechanism owns a job. Two features that sound similar usually solve different problems, and the exam is testing whether you know which.

• Confusing entitlement management with access reviews. One packages access and grants it; the other examines access that already exists.
• Reaching for a directory role when the task needs a scoped or delegated permission instead.
• Missing that a question is about the guest's home tenant rather than yours.
• Treating password protection and multifactor requirements as interchangeable answers to a phishing scenario.
• Forgetting that eligibility and activation are different things, so a role somebody holds permanently is not just-in-time however it was granted.

What the exam weights, and what that means for your time

The four areas sit within a few points of each other, so there is no block small enough to skip. Authentication and access is the largest, and it is also the one the others depend on, so it earns the extra time twice over.

• Managing user identities, 20 to 25%. Tenant configuration, roles and administrative units, users and groups, external collaboration, and hybrid identity.
• Authentication and access, 25 to 30%. Authentication methods, Conditional Access, identity protection and risk, and Global Secure Access.
• Workload identities, 20 to 25%. Managed identities and service principals, enterprise applications, app registrations, and app access control.
• Identity governance, 20 to 25%. Entitlement management, access reviews, privileged access and PIM, and monitoring identity activity.

Build these in a lab, once each

A trial tenant costs nothing and the whole exam is configuration you can touch. Every item below has appeared in a scenario in some form.

• Create a dynamic group and change a user attribute so you see how long membership takes to follow.
• Write one Conditional Access policy, put it in report-only, and read what the sign-in logs say about it.
• Register an application, grant it a permission, and look at the difference between a delegated and an application permission in the consent screen.
• Make a role eligible in Privileged Identity Management, activate it, and watch what the audit record captures.
• Run an access review over a group you own, and see what the reviewer is shown and what the recommendation is based on.
• Invite a guest, then look at what exists in your tenant and what still lives in theirs.

How to use practice tests alongside this

Sit one early, before the material feels finished, because the score is not the point: finding your two weakest areas is. Workload identities is worth checking first, since it sits at the end of most study plans and is the easiest block to arrive at with nothing left in the tank.

Sit another at the end of each block. If Conditional Access questions keep going wrong, stop reading and go and build the policy, because it is a topic that yields to ten minutes in the portal and resists an hour of documentation.