Passed SC-100 last week — identity management section was the sleeper topic

The MCRA callout is useful — thanks. Most prep guides treat it as supplementary. Sounds like it's more load-bearing than that for the actual exam questions.

What resources did you use beyond the MCRA? I have AZ-500 and SC-200 and I'm planning SC-100 for Q3. Trying to figure out if official Microsoft Learn is enough or if I need a third-party course.

The hybrid identity architecture questions are where I see most people struggle. There's a real gap between "I know how Entra ID works" and "I can design an identity architecture for 50,000 users across three countries with regulatory requirements." The latter is what SC-100 tests.

812 on SC-100 is a solid score. That exam has a reputation for being harder than the other SC-series in terms of requiring genuine architectural reasoning vs recall. Congrats.

The zero-trust framing runs through the entire exam. If you're prepping and haven't fully internalized the Microsoft Zero Trust model (identity, endpoints, apps, data, infrastructure, networks), that's worth doing before you sit. Every section connects back to it.

Congrats on the pass! Identity management was my sleeper too. I spent way too much time drilling Zero Trust architecture and barely touched the identity governance stuff — then the exam hit me with like five questions on entitlement management and access reviews that I wasn't fully ready for. The thing that actually saved me was grinding through sc 100/questions/security posture management the night before, which got me thinking more holistically about how identity fits into the overall posture picture instead of treating it as its own silo.

If you've got AZ-500 under your belt you'll recognize a lot of the concepts, but don't assume that means you can skim the identity sections. The exam wants you to reason about design decisions, not just recall features. That shift in thinking is what I'd focus on if I were starting over.

Failed my first attempt with a 693 and identity governance was a big part of why. I'd gone in confident from my AZ-500 experience and basically skipped a lot of the Entra ID Governance and lifecycle management stuff thinking I already knew it. I didn't. Second time around I spent two full weeks just on that area, worked through the sc 100/questions/security posture management practice questions until I was bored of them, and it made a real difference.

The thing I changed most was slowing down on scenario questions instead of rushing to the "obvious" answer. A lot of what tripped me up first time was picking the AZ-500 answer when the SC-100 wants the architect-level answer, which is usually about policy and governance over technical controls. Once I got that mental shift right it clicked. If you're retaking, don't skip the identity section assuming your certs have it covered.

Honestly, fitting in SC-100 prep around a full-time job was the hardest part. I'm a dad too, so I basically had two windows: 6-7am before the kids woke up and sometimes lunch breaks. I didn't try to cram everything at once. I'd do a focused 45-minute session on one domain, then let it sit. Spaced repetition actually worked better than marathon weekends ever did for me.

On the identity management stuff the OP mentioned — totally agree it sneaks up on you. I thought my AZ-500 background had me covered and it really didn't. The SC-100 goes deeper into the architectural reasoning behind zero trust identity decisions, not just the config steps. I spent a good chunk of my last week going through sc 100/questions/security posture management style questions because that's where a lot of the tricky scenario framing lives. If you're studying part-time, I'd say front-load the identity and posture domains early while your brain's still fresh, and save the compliance mapping stuff for when you're more warmed up.