AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID). They have many guest users with access to internal SharePoint sites and applications. They need to review guest user access every 90 days and automatically remove access if the guest does not respond to the review request. The solution must be fully automated without custom scripting. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Test-takers frequently confuse Privileged Identity Management (PIM) with Access Reviews, but PIM is designed for privileged roles and requires activation, whereas Access Reviews handle recurring attestation of any user's access, including guest users, with automatic removal on non-response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Access Reviews
Microsoft Entra ID Access Reviews is the correct feature because it allows administrators to create recurring reviews of guest user access to groups, applications, and SharePoint sites. It can be configured to automatically remove access if the guest does not respond within a specified period (e.g., 90 days), and it supports full automation without custom scripting by leveraging built-in review schedules and auto-apply actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Access Reviews
Why this is correct
Microsoft Entra ID Access Reviews are the governance feature that handles the recurring recertification of guest accounts, group memberships, and application assignments. An admin can create a review that periodically asks guest users to self-attest or asks their manager to approve continued access, with automatic removal after a specified non-response period. This ensures guest access is regularly validated and cleaned up, meeting the requirement described.
- ✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Conditional Access is a runtime policy engine that evaluates sign-in events based on conditions such as user risk, device compliance, and network location, then grants or blocks access in real time. While it can require multi-factor authentication for guests, it neither inventories existing access nor initiates removal of users who already possess permissions. Therefore, it cannot satisfy the need to periodically review and purge stale guest access.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Identity Protection is a detection service that uses machine learning to identify risky authentication behaviors such as impossible travel, leaked credentials, or known malicious IP addresses. It focuses on whether a user's authentication attempt is likely compromised, not on whether their existing access permissions remain appropriate. Managing guest access reviews is outside its scope because it never aggregates the full list of guest assignments for an approval workflow.
- ✗
Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) enables just-in-time activation for privileged Microsoft Entra ID roles and Azure resource roles with time-bound, approved assignments. It is designed to reduce standing admin access by requiring users to activate a role for a limited window, not to conduct periodic reviews of non-privileged guest access or application entitlements. Although guests can be added to privileged roles, PIM's review capabilities are role-centric rather than a general-purpose guest access recertification tool.
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.