AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID and wants to automate the lifecycle management of user accounts in their SaaS applications, such as Salesforce and ServiceNow. The solution should automatically create, update, and deactivate accounts when users join, move, or leave the organization. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra ID Connect (which syncs to Entra ID) with provisioning to external SaaS apps, or they mistakenly think Entitlement Management handles account creation when it only manages access rights, not identity lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Provisioning
Microsoft Entra ID Provisioning (specifically, HR-driven provisioning) automates the creation, update, and deactivation of user accounts in SaaS applications like Salesforce and ServiceNow based on changes in the organization's HR system or directory. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize identity lifecycle events, ensuring accounts are automatically created when users join, updated when they move, and deactivated when they leave.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Provisioning
Why this is correct
Microsoft Entra ID Provisioning is the correct service because it automates the entire identity lifecycle in SaaS applications by creating, updating, and deactivating user accounts based on authoritative sources such as HR systems or Microsoft Entra ID itself. It uses the SCIM 2.0 protocol, built-in app connectors, attribute mapping, and scoping filters to keep account statuses synchronized, and supports on-demand provisioning for immediate changes. This directly fulfills the requirement to automate user account management in external applications.
- ✗
Microsoft Entra ID Connect
Why it's wrong here
Microsoft Entra ID Connect is designed for hybrid identity synchronization between on-premises Active Directory and Microsoft Entra ID, not for managing user accounts within SaaS applications. It replicates directory objects (users, groups, password hashes) to the cloud identity store, but it does not connect to or update accounts inside Software-as-a-Service applications. Therefore, it cannot automate account creation or deactivation in SaaS apps as required.
- ✗
Microsoft Entra ID Application Proxy
Why it's wrong here
Microsoft Entra ID Application Proxy provides secure remote access to on-premises web applications by publishing them through the Entra ID authentication layer, using an outbound connector and pre-authentication policies. Its scope is network access and session security, not identity lifecycle administration. It neither creates nor disables user accounts in any target application, making it entirely unsuitable for automating user provisioning.
- ✗
Microsoft Entra ID Entitlement Management
Why it's wrong here
Microsoft Entra ID Entitlement Management focuses on governing access by creating access packages, assignment policies, and periodic access reviews, but it assumes the underlying user accounts already exist in the target applications. It can grant or revoke a user's permission to an application, yet it does not provision, update, or deactivate the actual user account records in that application. Hence, it is a tool for authorization governance, not identity lifecycle automation.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.