AZ-500 Manage identity and access Practice Question
A company uses Microsoft Entra ID (Azure AD) and wants to regularly review the membership of a group that grants access to a critical application. Each member must attest their continued need for access. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Candidates often confuse Privileged Identity Management (PIM) with access reviews, but PIM is for privileged roles (e.g., Global Administrator) while access reviews are for any group or application access, including non-privileged memberships.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Identity Governance access reviews
Microsoft Entra ID Identity Governance access reviews enable administrators to create recurring reviews of group memberships, requiring each member to attest their continued need for access. This directly addresses the requirement for regular attestation of group membership for a critical application, as it automates the review process and ensures compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Identity Governance access reviews
Why this is correct
Access reviews in Microsoft Entra ID Identity Governance are the native mechanism for recurring membership attestation. You can target an Microsoft Entra ID group, application, or access package, and select reviewers—such as resource owners or the members themselves—to confirm each user still needs access. A review can be configured to recur automatically, and the completion logic can remove denied or non-responsive users from the group. This directly matches the requirement to periodically attest group membership and remediate stale access.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management addresses just-in-time elevation of privileged roles, such as Global Administrator or Contributor, with time-bound activation and optional approval workflows. While PIM can manage privileged access groups that grant Microsoft Entra ID roles to members, its scope is limited to privileged role activation and renewal, not to general group membership reviews. It does not offer recurring attestation for normal Microsoft Entra ID groups, so it cannot meet the stated requirement for periodic membership verification.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Conditional Access is a policy engine that evaluates contextual signals—like user location, device compliance, or sign-in risk—at authentication time to allow or block access. It operates at the point of sign-in and does not audit existing assignments or require review of current group memberships. Since there is no workflow for scheduled review cycles and automatic removal of users from groups, it cannot be used for membership attestation.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection analyzes risk signals associated with users and sign-ins, such as leaked credentials, anonymized IP addresses, and impossible travel, to assign a risk level. This risk is then used to enforce protections like MFA challenge or password change via Conditional Access policies. However, Identity Protection does not track group membership or provide a mechanism for owners to review and approve continued access; it only flags potentially compromised entities.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.