Build Your Free SC-300 Lab: Microsoft Entra Tenant, P2 Trial and Azure (Step by Step)

Part 2 of the SC-300 Microsoft Identity and Access Administrator series

You cannot pass SC-300 by reading alone. The exam expects you to know how tenants, users, licenses, Conditional Access and Privileged Identity Management behave in a real directory, and the fastest way to learn that is to break things in a lab that costs nothing.

In this post you will build a free practice environment: an Azure free account, your own Microsoft Entra tenant, test users, an emergency access account, and a Microsoft Entra ID P2 trial. Every demo in the rest of this series runs in this lab. Plan on 45 to 60 minutes.

Previous Article: SC-300 Exam Guide

Quick Summary

• Sign up for an Azure free account with a brand-new Microsoft account, so you get a clean directory that is not tied to your employer
• Your Azure free account gives you a Microsoft Entra tenant to practice in, and you become its Global Administrator
• Create a few test users and one emergency access account
• Activate the Microsoft Entra ID P2 trial so you can practice Conditional Access risk policies, PIM and access reviews
• Do not use your work tenant for practice. A lab mistake in a production tenant can lock real users out

What You Will Build

Before You Start

• A phone number for verification.
• An email address you can read. Microsoft may ask for one during sign-up.
• Possibly payment details. Trial sign-ups can ask for them. Read each screen and check that you are starting a free trial.
• A separate browser profile (or a private window) so you do not mix lab sign-ins with your work account.
• A notes file. Write down the tenant name, tenant ID, admin account and trial end date as you go.
• About an hour. Some steps, such as license activation, can take a few minutes to appear.

Know the Trial Clock and the Limits

The Entra ID P2 trial usually lasts 30 days from activation, so read the end date on the activation page. A few facts shape the plan:

• One trial per tenant. Microsoft Q&A answers say a tenant that already holds an Entra trial is asked to create a new tenant when you try to start another one. That is why we do not start with P1 and add P2 later.
• Extending the trial. Microsoft 365 trials can usually be extended once, by up to 30 days, from Billing > Your products in the Microsoft 365 admin center if an Extend trial option appears, and it may ask for a card. I have not found out yet whether this P2 trial offers it, and I will update this post when I do. Plan for 30 days.
• A fallback to try. If the trial expires and no extension is offered, a Microsoft 365 E5 trial is one option to try, because Microsoft’s pricing page says Entra ID P2 is included with Microsoft 365 E5. Offers and rules vary, so check the Microsoft 365 admin center for what your tenant is offered. Start any new trial from your lab tenant, signed in as its Global Administrator, and not through Sign up, so you do not create another tenant. Do this for learning only.
• No automatic switch to a paid plan. Answers on Microsoft Q&A say the tenant reverts to the Free edition when the trial ends. Still check Billing in the Microsoft 365 admin center for your own trial.

Here is what to expect when the trial ends, based on Microsoft’s licensing documentation and Microsoft Q&A:

So plan like this: Modules 0, 1, 3 and 5 mostly work on the Free edition. Modules 2 and 4 are where P2 matters (risk-based Conditional Access, Identity Protection, PIM, access reviews). Practice those episodes together while the trial is active. If you are creating the series, record the P2 episodes in one block, and publish them over the following weeks.

The Azure free account has its own limits. From Microsoft’s page at the time of writing: a USD 200 credit to use within 30 days (check the amount for your country), free monthly amounts of 20+ popular services for 12 months (new customers only), and 65+ always-free services. To keep receiving free services, you need to move to pay-as-you-go pricing within 30 days or when the credit runs out, whichever comes first. Microsoft allows one free account per new customer.

Step 1: Start the P2 Trial and Create Your Lab Tenant

1. Open Microsoft’s Entra plans and pricing page and select Try for free under Microsoft Entra ID P2.
2. When you are asked to Sign in or Sign up, choose Sign up. You do not have a tenant yet, and Sign up is the option that creates a new Microsoft Entra tenant. (Sign in is only for an existing tenant and an existing administrator account.)
3. Follow the prompts to create your organization account. You will choose an organization name and a domain name ending in onmicrosoft.com, for example sc300lab, and a password for the first admin account. You usually cannot change the onmicrosoft.com name later, so pick one you can live with.
4. Check that the screens say free trial, and note the end date.
5. Sign in to the Microsoft Entra admin center with your new organization account.

I checked that this route works directly from the Entra plans and pricing page. I stopped just before the billing step, so read that screen yourself. This flow can be messy. Screens change, errors can appear, and you can end up with two tenants, so do not repeat the sign-up to see what happens. If a screen looks different from this guide, read it carefully and stop if it asks for something you did not expect.

Step 2: Check Your Tenant

In the Microsoft Entra admin center, open Entra ID (called Identity in some versions of the portal) and then Overview. Note down:

• Tenant name and tenant ID. You will see the tenant ID again in app registrations, logs and PowerShell.
• Primary domain. It ends in onmicrosoft.com. You can add a custom domain later in Episode 1.2.
• Licenses. Open Licenses > All products and confirm that the Microsoft Entra ID P2 trial is listed, with its end date.
• Your role. Under Roles and administrators, check that your account is a Global Administrator. By default, the person who creates a tenant gets that role.

One limit to know: Microsoft says only paid customers can create additional workforce tenants from the admin center, and people using a free tenant or trial subscription cannot. If you need a second tenant later, plan a separate sign-up. In Step 7 the Azure sign-up gives you one.

Step 3: Check the Billing and the Trial Dates

In the Microsoft 365 admin center (admin.microsoft.com), open Billing and then Your products. Confirm that your P2 product is a free trial, note when it ends, and check whether any payment method is attached and whether anything renews. If you see an Extend trial option, you now know how to use it. Put a reminder in your calendar three days before the end date, so you can export your work (Step 6).

Step 4: Create Lab Users and Assign the P2 License

Create a small, consistent set of users so every later demo uses the same names.

To create a user:

1. Go to Entra ID > Users > All users and select New user > Create new user.
2. Enter the user principal name (for example user01 at your onmicrosoft.com domain), display name and a strong password.
3. Under Properties, set Usage location. You need it before you can assign a license.
4. Select Review + create, then Create.

Then assign the license: open Licenses > All products, select Microsoft Entra ID P2, choose Licensed users or Licensed groups, and assign it to your lab users. We will create users in bulk with a CSV file and PowerShell in Episode 1.5.

Step 5: Create an Emergency Access Account

Microsoft recommends that organizations have two cloud-only emergency access accounts that are permanently assigned the Global Administrator role. They are for situations where normal admin accounts cannot sign in, for example when a Conditional Access mistake locks everyone out. This is also an SC-300 exam topic (create and manage emergency access accounts).

In your lab, create at least one:

1. Create a cloud-only user, for example emergency01, with a long random password.
2. Assign the Global Administrator role to it (Roles and administrators > Global Administrator > Add assignments).
3. Store the password somewhere offline, such as a password manager you trust or a printed sheet in a safe place.
4. Remember to exclude this account from Conditional Access policies when we build them in Module 2.

We cover emergency access design properly in Episode 4.12.

Step 6: Build Your Rebuild Kit

Your users and settings live in the tenant. They do not disappear when the trial ends, but some premium settings do, and a repeated sign-up creates a separate, empty tenant. So treat the lab as something you can rebuild in minutes:

• Export your users. Open Users > All users and download the list as a CSV file. Episode 1.5 shows how to import users in bulk from a CSV file.
• Keep a notes file. Tenant name and ID, domain, admin names, where the passwords are stored, and the trial end date.
• Save your settings. Take a screenshot after each episode. For Conditional Access policies, copy the policy JSON if your portal offers it. Write down PIM role settings, because they are removed when the trial ends.
• Keep your scripts. Store the PowerShell scripts we use for users, groups and role assignments in one folder.
• Back up three days before the trial ends. Export the users again and capture your latest settings.
• Use Sign up only once. If you ever need another trial (such as Governance), activate it from the Licenses page of your lab tenant, or choose Sign in with its Global Administrator.

Step 7: Add Azure Later and Attach It to Your Lab Tenant

You do not need Azure for Modules 0 to 2. When you reach Module 3 (managed identities) and Module 4 (PIM for Azure resources), first open Subscriptions in the Azure portal while signed in to Lab-Main. In my lab, the organization account created by the P2 trial also showed an Azure free subscription there. If you see one, you can use it and skip the rest of this step. If you do not, add Azure like this:

1. Sign up for the Azure free account with a personal Microsoft account. Microsoft’s page says you sign up with a Microsoft account or a GitHub account, and it is one free account per new customer. If you already have one, use it.
2. This sign-up creates a tenant of its own. Treat it as Lab-Partner, which you will use for guests and cross-tenant sync in Episodes 1.12 to 1.14.
3. Invite your Azure sign-in account into Lab-Main as a guest (Users > New user > Invite external user) and accept the invitation.
4. In the Azure portal, open Subscriptions, select the subscription, then Change directory, and choose Lab-Main. You need the Owner role on the subscription.
5. Azure role assignments are removed when you change the directory. Check Access control (IAM) afterwards, and sign in as a Global Administrator of Lab-Main if you need to regain access.
6. Create a resource group, for example rg-sc300-lab, and in Cost Management + Billing look for Budgets to set a small budget alert.

If Change directory fails, Microsoft Q&A answers suggest opening an Azure support request. Read Microsoft’s pages on associating a subscription with a tenant and transferring a subscription to a different directory first.

Your Two Tenants

Users belong to one tenant. If you cannot see your users, you are signed in to the other tenant. Click the gear icon and open Directories + subscriptions to switch, and use a separate browser profile for each tenant. If a trial ever creates an extra tenant, check Licenses in each one: the tenant with P2 is Lab-Main. Delete an extra tenant only after checking that it holds nothing you need.

Optional: Extend the Lab for Later Episodes

Lab Safety and Cost Tips

• Never test Conditional Access in your work tenant. Even in a lab, start with Report-only mode and keep your emergency account excluded.
• Keep your lab sign-in details in a password manager and turn on multifactor authentication for your admin account.
• Delete Azure resources when a demo ends, and check Cost analysis every few days once you add Azure.
• Write down your tenant ID, subscription ID and user names in one notes file. You will reuse them.
• Take a screenshot or notes of your starting state, so you can rebuild quickly if something breaks.

Common Problems and Fixes

Lab Checklist

• Started the P2 trial with Sign up and created my lab tenant
• Noted the tenant name, tenant ID, primary domain and trial end date
• Confirmed my account is a Global Administrator
• Checked Billing and confirmed this is a free trial
• Created labadmin and user01 to user05, with usage location set, and assigned the P2 license
• Created and secured an emergency access account
• Exported my users to a CSV file and started my notes file
• Set a calendar reminder three days before the trial ends
• Later: signed up for the Azure free account with a personal Microsoft account
• Later: moved the subscription to Lab-Main and checked access control
• Later: created the rg-sc300-lab resource group and a budget alert
• Labeled my tenants (Lab-Main holds P2, Lab-Partner came from Azure)

How This Lab Connects to the Exam

The SC-300 study guide expects hands-on skill with several tasks you just practiced: creating and managing users, assigning and reporting on licenses, configuring tenant properties and domains, and creating and managing emergency access accounts. You do not need a paid tenant to prepare for them.

Free Resources and Links

If a trial or tenant does not behave as expected, these Microsoft pages help: Microsoft Entra plans and pricing for the trial, Sign up for Microsoft Entra ID P1 or P2 editions for Sign in versus Sign up, Microsoft Entra licensing for what happens when licenses expire, Associate or add an Azure subscription to your Microsoft Entra tenant and Transfer an Azure subscription to a different Microsoft Entra directory for the subscription move.

What Is Next

Your lab is ready. In the next post we cover identity fundamentals: authentication vs authorization, OAuth 2.0, OpenID Connect, SAML and Kerberos, so every demo that follows makes sense.

Have a problem with the lab setup? Leave a comment with the exact error message and I will help.