Finance entitlement approval
Confirm why Jordan needs membership in the assigned reader group and how long access is authorized.
SC-300 / NORTHSTAR / PRACTICE WORKBENCH
INCIDENT IAM-990 · IDENTITY ADMINISTRATIONOne outage.
Five identity systems.
Work a focused version of Northstar’s Expense Portal incident. Investigate sign-ins, provisioning and approvals, restore two separate causes, and verify six access outcomes. For the full cross-domain final challenge, continue to Lab 015 on JoeLearns Labs.
NORTHSTAR OPERATIONS / ON CALL0 / 6Acceptance checks verified
Investigate the initial evidence before making changes.
Browser-session progress only · Not an exam-readiness prediction01 / INVESTIGATION
Inspect the evidence
Start with the symptoms. Examine each source to distinguish the triggering policy change from other identity and application failures. The records are intentionally incomplete until you open the source.
SERVICE DESK / HIGH PRIORITYExpense Portal access interrupted
Jordan from Operations reports that Expense Portal worked earlier this morning. Casey in Finance also sees a device-compliance block; Jamie in Marketing has never been assigned. Support was about to recommend disabling Conditional Access for the whole tenant.
FIRST REPORTED09:16 UTCFictional / November 6
No artifact opened
Select a log source on the left to inspect Northstar's incident evidence. Begin with the sign-in records.
0 of 6 sources examinedInspect sign-in, audit, provisioning and app-assignment evidence to unlock diagnosis.
02 / ROOT-CAUSE ATTRIBUTION
Two separate failures. One incident.
Choose the policy-level cause, the directory-to-application cause and who initiated the policy change. Both causes must be correct. This is an assessment of observed evidence, not guesswork from a single error code.
No submitted diagnosis yet.
03 / AUTHORIZED CHANGES
Repair without weakening access
Two changes are required. An application assignment requires governance approval; a Conditional Access policy change requires approved temporary PIM elevation. A convenient shortcut may resolve one symptom while failing the wider security check.
Temporary CA administrator activation
Use the least privileged eligible role needed to update a tenant-wide CA policy.
CONTROLLED REMEDIATION
Change the actual settings
These changes affect the same model tested below. Mistargeting or overprivileging access has observable consequences.
Current: All employees
Current: Stale mapping
Close the privileged change window
After modifying CA, deactivate the temporary role. A completed change cannot leave privileged access active.
LAST EVENT / 0 RECORDED
Review the initial incident before performing changes.
04 / ACCEPTANCE TESTS
Prove the resolution, not just the symptom
Run all six checks against the current state. The acceptance matrix includes legitimate access, a prohibited operation, an excluded identity, Finance device protection, emergency recovery and privilege deactivation.
App + CA · Expected PERMITTEDJordan reads Expense Portal
Not run
App role · Expected DENIEDJordan modifies expense records
Not run
Assignment · Expected DENIEDUnassigned Jamie reads Expense Portal
Not run
Conditional Access · Expected DENIEDNoncompliant Finance pilot user signs in
Not run
Resilience · Expected PERMITTEDEmergency administrator recovers the tenant
Not run
PIM lifecycle · Expected DENIEDTaylor still has active CA admin privilege
Not run
ACCEPTANCE RESULTS0 / 6Complete all positive, negative and privilege/recovery checks on the final configuration.
05 / SUPPORT HANDOFF
Leave a defensible incident record
Every inspection, approval, configuration change and validation is recorded in this fictional session. A real change requires independent production evidence and an approved rollback plan.