SC-300 Skills Outline Updated for October 28, 2026: What Actually Changed

Direct answer

Microsoft refreshed the SC-300 study guide for skills measured as of October 28, 2026. The four exam domains and their weight ranges did not change. The update is wording and structure inside three functional groups: authentication methods (OAuth 2.0 tokens was removed from the listed examples) and Global Secure Access (the objective names now match the current Microsoft Entra Private Access, Internet Access, and Microsoft traffic profile naming). Privileged access objectives now say "emergency access accounts" instead of "break-glass accounts." Our recommendation is to continue your study plan and review these three groups. The comparison does not establish changes to exam questions.

What changed

Comparison: October 28 outline (S1) versus April 27 outline (S2).

Both versions list four GSA objectives. Client deployment was already present in S2. The other three objective names changed; the comparison does not show an added objective.

What did not change

• The skills-at-a-glance lists show identical domains and weights: Implement and manage user identities (20-25%), Implement authentication and access management (25-30%), Plan and implement workload identities (20-25%), Plan and automate identity governance (20-25%).
• Both raw outlines also have a conflicting authentication domain heading of 20-25%. The 25-30% above follows their skills-at-a-glance lists; the supplied evidence does not resolve this discrepancy.
• Microsoft's own change log marks these skill areas "No change": audience profile, implement authentication and access management (the domain row), and plan and automate identity governance.
• Microsoft marks three functional groups "Minor": Plan, implement, and manage Microsoft Entra user authentication, implement Global Secure Access, and plan and implement privileged access.
• The audience profile still expects familiarity with PowerShell and Kusto Query Language (KQL). That line is unchanged.

What it means for candidates

• Global Secure Access naming. Review the revised objective names. S3 describes Microsoft traffic profile rules derived from the Microsoft 365 IP and FQDN list, with Forward or Bypass actions. The GSA client itself runs on Windows, Android, macOS, and iOS, and it uses a lightweight filter driver rather than a VPN connection, so it can run alongside other SSE tools.
• The compliant network check.: a named location called "All Compliant Network locations," wired into Conditional Access, where a typical policy blocks everything except that compliant network. It needs no egress IP ranges to maintain and it reduces token theft and replay risk.
• Emergency access accounts. Replace the old term in your notes. This wording comparison does not establish configuration requirements or whether operational guidance changed.
• Don't panic about OAuth 2.0. It was removed from the authentication-methods example list, but the authentication domain's weight did not move and the change log marks that domain "No change." The user authentication functional group is separately marked "Minor." The sources establish removal from an example list, not exclusion from all testable content.

One-week study checklist

This is our suggested review schedule, not a Microsoft requirement or a prediction of exam questions.

1. Day 1: Re-read the current SC-300 study guide skills-at-a-glance section end to end. Confirm your notes use the current GSA objective names.
2. Day 2: Review Microsoft Entra Private Access and Internet Access concepts, plus the Microsoft traffic profile for Microsoft 365. Write one sentence each on what it does.
3. Day 3: Walk through the compliant network how-to and the Conditional Access named-location concept. Note why it lowers token-replay risk.
4. Day 4: Review the privileged access objective and update the account terminology. Do not infer MFA requirements from this wording change.
5. Day 5: Review authentication methods (certificate-based auth, Temporary Access Pass, Authenticator, passkeys/FIDO2). Record the removed example without assuming broader exam exclusion.
6. Day 6: Review Conditional Access, lesson 6, including its Global Secure Access section (S4).
7. Day 7: Take a practice run focused only on the three "Minor" change-log areas (authentication, GSA, privileged access). Retain coverage of all four domains.

FAQ

Does this update change the SC-300 exam weights? Their skills-at-a-glance weights match. Both raw versions contain the authentication heading discrepancy noted above.

Is OAuth 2.0 gone from the SC-300 exam? It was removed from the listed examples under the authentication-methods objective. The supplied evidence does not establish removal from tested content more broadly.

What is a "break-glass account" called now? The current study guide calls it an emergency access account. The wording comparison does not establish unchanged operational guidance.

Do I need to restart my study plan? Our recommendation is to continue your plan and review all three revised groups. The matching domain lists and limited wording changes support focused review.

Sources

• S1: Microsoft Learn, SC-300 study guide, current version, "Skills measured as of October 28, 2026," last updated 2026-08-16. https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-300
• S2: Same page, previous version, "Skills measured as of April 27, 2026," Wayback Machine snapshot 2026-05-11. https://web.archive.org/web/20260511191626/https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-300
• S3: Microsoft Learn, Global Secure Access documentation (captured October 27, 2026). https://learn.microsoft.com/en-us/entra/global-secure-access/
• S4: Protego, /courses/sc-300 (merged PR #138, October 27, 2026), aligned with S1 and adds a Global Secure Access section to Lesson 6. https://protego.me/courses/sc-300