ESEN

← Fine print by exam

Microsoft Azure · Associate

SC-300 · Microsoft Identity and Access Administrator

Microsoft Certified: Identity and Access Administrator Associate

Current↗ Official guide🃏 Practice these gotchas

Secretless CI/CD deployments (OIDC federation)

IAM● verified 34 days ago◌ no external reviewer

The subject must match exactly, with no wildcards, and there are at most 20 credentials per identity

In Azure trust isn't a policy: each federated identity credential is an issuer + subject pair that must match the token's sub character by character. There are no wildcards, so you need one credential per environment, branch or tag, capped at 20 per identity. In AWS or GCP you'd use StringLike or a CEL condition. Watch out: a wrong subject is created without error, and the failure only shows up at login.

Helps with:AZ-400SC-300
⚑ Report outdated

See it in the pattern →

Zero Trust private web API with passwordless PostgreSQL

IAM● verified 34 days ago◌ no external reviewer

ARM adds Entra admins; the app's role is created with SQL

Entra principals are added as administrators from the Azure portal or the ARM API. With isAdmin=true, pgaadauth_create_principal gives them azure_pg_admin, CREATEROLE and CREATEDB. For the app identity to be a regular user, an Entra admin can run pgaadauth_create_principal('<name>', false, false). For managed identities and service principals the name is the display name. The module outputs the exact SQL.

Helps with:AZ-305SC-300
⚑ Report outdated

See it in the pattern →

IAM● verified 34 days ago◌ no external reviewer

The Entra token for PostgreSQL isn't requested for the server FQDN

The password is an access token whose resource is https://ossrdbms-aad.database.windows.net (public cloud), not the server URL. It's the most common mistake when migrating from RDS, where the "token" is a signature generated locally with IAM credentials. Azure Identity libraries handle it if you request the right scope.

Helps with:SC-300
⚑ Report outdated

See it in the pattern →