SC-300 custom security attribute role and object statements
Short answer
The correct selections are No, Yes, No: Global Administrator lacks default custom security attribute permissions; Attribute Assignment Administrator can update custom security attribute keys and values for users and service principals; groups cannot receive custom security attributes.
Question
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the identities shown in the following table.
You have an attribute set named Custom1 that contains the custom security attributes shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Key Takeaways
It tests the separation between custom security attribute definition and assignment plus supported object types; the main trap is assuming Global Administrator has implicit access or that groups can be targeted.
This SC-300 hotspot tests who can manage custom security attributes and which Entra objects support them. The correct selections are No for Global Administrator default access, Yes for Attribute Assignment Administrator key/value updates on users and service principals, and No for assigning attributes to a group.
Common mistake: Assuming Global Administrator can automatically manage custom security attributes or that any directory object such as a group can receive them; default role separation and supported object types decide the answer.
Expert Analysis
Default administrator roles do not grant custom security attribute access The first statement is false because custom security attributes are deliberately separated from ordinary directory administration. Microsoft Entra’s role model states that Global Administrator and most other administrator roles do not receive read, define, or assign permissions for custom security attributes by default. A learner note on this page makes the same point: the Global Administrator role does not have permissions to read, define, or assign custom security attributes. Therefore the presence of a Global Administrator in the users table does not make that user able to assign or read Custom1.
Assignment role versus definition role The second statement is governed by the custom security attribute role split. Attribute Definition Administrator manages the attribute set and definitions, which form the schema. Attribute Assignment Administrator manages assignments for supported objects, including custom security attribute keys and values for users and service principals. That role does not become a schema owner, but it can update the key/value assignments on the object. A comment disputes this by saying the assignment role cannot update keys; the exam distinction is between editing definitions and updating assigned key-value pairs, and the documented permission for Attribute Assignment Administrator is the latter.
Supported object types decide the last row The final statement is false when it targets a group. Custom security attributes can be assigned to users, service principals, including enterprise applications, and managed identities, not to groups. A comment excerpt points to the same supported set: users and enterprise applications. Therefore the group identity in the table cannot receive a custom security attribute, while a user or service-principal/enterprise app can.
Answer The selections are No, Yes, No.
Official Reference
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-security-attributes-overview
- https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-security-attributes-manage
These links open the official vendor documentation in a new tab.
Exam Strategy
Treat each yes/no row as an independent role or object-type check. First ask whether the stated role has that permission by default, then ask whether the target object type supports custom security attributes. Do not let a Global Administrator title imply access, and do not treat groups like users or service principals.
Frequently Asked Questions
Can a Global Administrator assign custom security attributes by default?
Can custom security attributes be assigned to groups?
What can an Attribute Assignment Administrator manage?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
KindFlame 👍 31 - No "By default, Global Administrator and other administrator roles do not have permissions to read, define, or assign custom security attributes." 2 - Yes Attribute Assignment Administrator can update custom security attribute keys and values for users and service principals 3 - No You can assign Custom Security Attributes for the following Microsoft Entra Users and Enterprise Applications (service principals) https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview
-
Frippy 👍 1Attribute Assignment Administrator can NOT update custom security attribute keys
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →