Plan and Implement Workload Identities

Plan and implement identities for applications and Azure workloads, integrate enterprise applications, manage app registrations, and monitor app access.

5 minutes 5 Questions

Plan and Implement Workload Identities refers to the process of managing non-human identities in Microsoft Entra ID (formerly Azure AD) that are used by applications, services, and automated processes to access resources. **What Are Workload Identities?** Workload identities represent software wor…

Concepts covered
Service Principals and Application IdentitiesManaged Identities for Azure ResourcesEnterprise Application Settings and ConfigurationSaaS Application IntegrationUser and Admin Consent ConfigurationApp Registration and Authentication ConfigurationConditional Access App Control and Session PoliciesManaged Identity Assignment and Resource AccessMicrosoft Entra Roles for Application ManagementOn-Premises App Integration with Application ProxyUser, Group, and App Role AssignmentApplication Collections ManagementAPI Permissions and App RolesDefender for Cloud Apps Configuration and DiscoveryOAuth App Policies and Cloud App Catalog
Test mode:
Start practice test

SC-300 - Plan and Implement Workload Identities Example Questions

Test your knowledge of Plan and Implement Workload Identities

Question 1

A team wants to register a new web application in Microsoft Entra ID. Where do they go in the Microsoft Entra admin center to create the app registration?

Correct Answer: Identity > Applications > App registrations, then select New registration

To register a new application in Microsoft Entra ID, you navigate to Identity, then Applications, then App registrations, and select New registration, which launches the wizard to define the app name, supported account types, and redirect URI.

Enterprise applications is used to manage applications already integrated with your tenant, such as gallery apps or SAML-based apps, not to create new app registrations. Expose an API is a configuration option within an existing app registration, not a way to create one. Conditional Access is for defining access policies and has no app registration functionality.

Key concept tested: understanding the correct navigation path for app registration in the Microsoft Entra admin center.

Question 2

A company plans to publish several on-premises web applications using Microsoft Entra Application Proxy. The security team wants to evaluate whether Application Proxy is the best approach compared to other options. The applications use header-based authentication, and employees need access from personal devices. Which justification best supports recommending Application Proxy over a traditional VPN solution for this scenario?

Correct Answer: Application Proxy provides secure access to specific applications through Entra ID conditional access policies, limiting exposure of the internal network

Application Proxy is preferred over VPN because it provides granular, per-application access secured by Entra ID conditional access policies, avoiding the need to expose the entire internal network to personal devices.

The full network tunnel option describes VPN behavior, which is exactly what Application Proxy avoids by providing application-level access instead. Requiring device certificates and domain-joined machines is incorrect because Application Proxy works with personal (unmanaged) devices, which is a key advantage in this scenario. The reverse proxy in the DMZ requiring inbound firewall ports is wrong because Application Proxy uses outbound connections only through lightweight connectors, eliminating the need to open inbound ports.

Key concept tested: Application Proxy's zero-trust, per-application access model versus full network-level VPN access.

Question 3

An organization is planning to publish an internal web portal for external remote access. To achieve this, the IT networking team must configure and manage Microsoft Entra Application Proxy connectors on designated servers. The security guidelines dictate that this networking team must have the required permissions to manage the proxy connectors but must lack global directory privileges. You need to identify the most restricted built-in role to assign. Which approach should you use to fulfill this requirement?

Correct Answer: Assign the Application Administrator role to the network team.

The Application Administrator role provides the specific permissions required to manage all aspects of enterprise applications, including Application Proxy settings and connectors, without granting full global directory access.

The Cloud Application Administrator role intentionally excludes Application Proxy management capabilities. The Hybrid Identity Administrator role is designed for directory synchronization tools like Microsoft Entra Connect rather than app proxies. The Conditional Access Administrator role strictly manages access policies rather than application configurations.

The key concept tested is least privilege built-in role assignments for Microsoft Entra Application Proxy management.

More Plan and Implement Workload Identities questions
627 questions (total)
Practice 100 questions
One session at a time, always new questions