Build Your Free SC-300 Lab: Azure Free Account and Microsoft Entra Tenant (Step by Step)

Part 2 of the SC-300 Microsoft Identity and Access Administrator series

You cannot pass SC-300 by reading alone. The exam expects you to know how tenants, users, licenses, Conditional Access and Privileged Identity Management behave in a real directory, and the fastest way to learn that is to break things in a lab that costs nothing.

In this post you will build a free practice environment: an Azure free account, your own Microsoft Entra tenant, test users, an emergency access account, and a Microsoft Entra ID P2 trial. Every demo in the rest of this series runs in this lab. Plan on 45 to 60 minutes.

Previous Article: SC-300 Exam Guide

Quick Summary

• Sign up for an Azure free account with a brand-new Microsoft account, so you get a clean directory that is not tied to your employer
• Your Azure free account gives you a Microsoft Entra tenant to practice in, and you become its Global Administrator
• Create a few test users and one emergency access account
• Activate the Microsoft Entra ID P2 trial so you can practice Conditional Access risk policies, PIM and access reviews
• Do not use your work tenant for practice. A lab mistake in a production tenant can lock real users out

What You Will Build

Before You Start

• A new personal Microsoft account. Create one just for the lab. Do not use your work or school account, because the lab should have its own directory.
• A phone number for verification.
• A debit or credit card for identity verification. Microsoft says it does not charge the card when you sign up, but you may see a one-dollar (or equivalent) verification hold.
• A separate browser profile (or a private window) so you do not mix lab sign-ins with your work account.
• About an hour. Some steps, such as license activation, can take a few minutes to appear.

Know the Free Account Limits

From Microsoft’s Azure free account page at the time of writing:

• You get a USD 200 credit to use within 30 days. Check the page for the amount in your country.
• You get free monthly amounts of 20+ popular services for 12 months (new customers only) and 65+ always-free services.
• To keep receiving free services, you need to move to pay-as-you-go pricing within 30 days or when the credit runs out, whichever comes first.

For SC-300 you mostly work in Microsoft Entra, not in expensive Azure services, so the lab stays cheap. Avoid starting virtual machines or other resources you do not need, and delete what you create.

Step 1: Create Your Azure Free Account

1. Open a private window and go to the Azure free account page.
2. Select Start free and sign in with your new Microsoft account.
3. Fill in your profile, verify your phone number, and verify your card.
4. Accept the agreement and select Sign up.
5. When setup finishes, go to the Azure portal and the Microsoft Entra admin center and make sure you can sign in to both.

Signing up with a new account normally creates a new directory for you, with a name ending in onmicrosoft.com.

Step 2: Check Your Microsoft Entra Tenant

In the Microsoft Entra admin center, open Entra ID (called Identity in some versions of the portal) and then Overview. Note down:

• Tenant name and tenant ID. You will see the tenant ID again in app registrations, logs and PowerShell.
• Primary domain. It ends in onmicrosoft.com. You can add a custom domain later in Episode 1.2.
• License. A new tenant starts on Microsoft Entra ID Free.
• Your role. Under Roles and administrators, check that your account is a Global Administrator. By default, the person who creates a tenant gets that role.

One limit to know: Microsoft says only paid customers can create additional workforce tenants from the admin center, and people using a free tenant or trial subscription cannot. If you need a second tenant later (for cross-tenant sync in Episode 1.14), plan a second sign-up with another new Microsoft account.

Step 3: Create Lab Users

Create a small, consistent set of users so every later demo uses the same names.

To create a user:

1. Go to Entra ID > Users > All users and select New user > Create new user.
2. Enter the user principal name (for example user01 at your onmicrosoft.com domain), display name and a strong password.
3. Under Properties, set Usage location. You need it before you can assign a license.
4. Select Review + create, then Create.

We will create users in bulk with a CSV file and PowerShell in Episode 1.5.

Step 4: Create an Emergency Access Account

Microsoft recommends that organizations have two cloud-only emergency access accounts that are permanently assigned the Global Administrator role. They are for situations where normal admin accounts cannot sign in, for example when a Conditional Access mistake locks everyone out. This is also an SC-300 exam topic (create and manage emergency access accounts).

In your lab, create at least one:

1. Create a cloud-only user, for example emergency01, with a long random password.
2. Assign the Global Administrator role to it (Roles and administrators > Global Administrator > Add assignments).
3. Store the password somewhere offline, such as a password manager you trust or a printed sheet in a safe place.
4. Remember to exclude this account from Conditional Access policies when we build them in Module 2.

We cover emergency access design properly in Episode 4.12.

Step 5: Activate the Microsoft Entra ID P2 Trial

Many SC-300 topics need Premium features: risk-based Conditional Access, Identity Protection and PIM. Microsoft’s own training exercises use the Entra ID P2 trial for this.

1. In the Entra admin center, open the Licenses page and look for Get a free trial (the exact label and location vary by portal version).
2. Choose Microsoft Entra ID P2 and select Activate.
3. Wait a few minutes and refresh. The license should appear under Licenses > All products.
4. Select the P2 license, then Licensed users or Licensed groups, and assign it to your lab users.

Notes:

• The trial may ask for payment details, and Microsoft Q&A answers say it is limited to one trial per tenant.
• Trial length and availability can change, so read the activation page. The trial usually lasts 30 days, so activate it when you are ready to practice Module 2 and Module 4, not on day one if you are only starting Module 1.
• If activation fails, Microsoft Q&A threads from other users suggest creating a second cloud-only Global Administrator and trying the activation from that account, then signing back in as your main account.
• The Licenses page may also list other trials, such as Governance. Availability varies, so check what is offered to your tenant.

Step 6: Check Your Azure Subscription and Create a Resource Group

1. In the Azure portal, search for Subscriptions and confirm your free trial subscription is active.
2. Search for Resource groups, select Create, name it for example rg-sc300-lab, pick a region, and create it.
3. Optional but wise: in Cost Management + Billing, look for Budgets and create a small budget alert so you are warned if something starts spending your credit.

We will use this resource group in Module 3 (managed identities) and Module 4 (Azure roles in PIM).

Optional: Extend the Lab for Later Episodes

Lab Safety and Cost Tips

• Never test Conditional Access in your work tenant. Even in a lab, start with Report-only mode and keep your emergency account excluded.
• Keep your lab sign-in details in a password manager and turn on multifactor authentication for your admin account.
• Delete resources when a demo ends, and check Cost analysis in Azure every few days.
• Write down your tenant ID, subscription ID and user names in one notes file. You will reuse them.
• Take a screenshot or notes of your starting state, so you can rebuild quickly if something breaks.

Common Problems and Fixes

Lab Checklist

• Created a new Microsoft account for the lab
• Signed up for the Azure free account
• Signed in to the Azure portal and the Entra admin center
• Noted the tenant name, tenant ID and primary domain
• Confirmed my account is a Global Administrator
• Created labadmin and user01 to user05, with usage location set
• Created and secured an emergency access account
• Activated the Entra ID P2 trial and assigned licenses (when ready for Module 2)
• Created the rg-sc300-lab resource group
• Set a budget alert

How This Lab Connects to the Exam

The SC-300 study guide expects hands-on skill with several tasks you just practiced: creating and managing users, assigning and reporting on licenses, configuring tenant properties and domains, and creating and managing emergency access accounts. You do not need a paid tenant to prepare for them.

Free Resources and Links

What Is Next

Your lab is ready. In the next post we cover identity fundamentals: authentication vs authorization, OAuth 2.0, OpenID Connect, SAML and Kerberos, so every demo that follows makes sense.

Have a problem with the lab setup? Leave a comment with the exact error message and I will help.