AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID). They want to automatically review and remove guest accounts that have not signed in for 90 days. They also need to generate reports for auditors. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Watch out — candidates often confuse Privileged Identity Management (PIM) with Access Reviews because both involve 'reviewing' access, but PIM is strictly for privileged roles, not for reviewing inactive guest accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Reviews
Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest users' access. By configuring a review with a 'days since last sign-in' condition (e.g., 90 days), Entra ID automatically flags and can remove guest accounts that have not authenticated within that period. The review process also generates detailed audit logs and reports suitable for auditor compliance, directly meeting the stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection evaluates risk signals such as impossible travel, anonymous IP addresses, or leaked credentials to identify compromised user accounts and risky sign-ins. While it can trigger risk-based Conditional Access policies or require self-remediation for affected users, it is a detection engine rather than an access governance tool that can schedule recurring reviews or automatically remove guest accounts based on inactivity. Consequently, it does not fulfill the specific requirement for periodic recertification and automatic removal of unbidden guest access.
- ✓
Access Reviews
Why this is correct
Microsoft Entra Access Reviews are the intended mechanism for periodic attestation of guest users, because they allow creation of recurring review cycles that can be assigned to tenant admins, guest's manager, or the guest themselves. Reviewers are presented with activity indicators such as last sign-in, and the review policy can automatically apply the result to block or remove any user who is denied or who has been inactive for the configured threshold. This yields an auditable certification process for guest access, satisfying the requirement for scheduled recertification and automated cleanup.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) addresses just-in-time activation and oversight of elevated Microsoft Entra ID roles and Azure resource roles, using approval workflows and activation time limits to minimize standing privilege. It does not provide a node for reviewing ordinary user or guest account access, nor does it evaluate activity to determine whether a guest should be removed. Since the requirement is about regular guest account recertification rather than elevated role management, PIM is not the correct feature.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is an if-then policy engine that evaluates sign-time conditions, including user risk, device compliance, location, and application context, to either grant or block access or require additional controls like multi-factor authentication. It can protect applications in real time but lacks any capability to schedule audits, show historical usage, or delete a guest account after a period of inactivity. Thus while it might secure a guest's sign-in, it cannot implement the needed review-and-removal workflow.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.