AZ-500 Manage identity and access Practice Question
A company uses Azure AD B2B collaboration to invite external partner users. The security policy requires that guest users who have not signed in for more than 90 days should have their access automatically reviewed and, if not approved, removed. The company has Azure AD Premium P2 licenses. Which Azure AD feature should they configure to meet this requirement?
⚠ Common exam trap
Many exam-takers confuse blocking sign-ins via Conditional Access (Option B) with actually removing access, but Conditional Access only prevents future authentication and does not revoke existing permissions or trigger a review workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an Azure AD Access Review that reviews guest user access and automatically removes access after 90 days of inactivity.
Azure AD Access Reviews, available with Azure AD Premium P2 licenses, allow you to create recurring reviews that specifically target guest users who have not signed in for a specified period (e.g., 90 days). The review can be configured to automatically remove access if the reviewer does not approve, directly meeting the requirement for automatic review and removal after 90 days of inactivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable automatic user deletion in the Azure AD B2B collaboration settings.
Why it's wrong here
Azure AD B2B collaboration settings expose controls like domain restrictions, guest sign-up, and redemption behavior, but they do not provide any mechanism to automatically delete guest user accounts based on inactivity. There is no 'automatic user deletion' toggle in the Azure portal, and the Microsoft Graph API does not expose a property for self-cleaning stale accounts. Removing inactive guests requires a governance tool such as Azure AD Access Reviews, which can delete or block access, not a B2B settings toggle.
- ✗
Create a Conditional Access policy that blocks sign-ins for guest users who haven't authenticated in 90 days.
Why it's wrong here
Conditional Access policies evaluate sign-in risk or conditions at the time of authentication. They cannot retroactively remove access for users who have already been inactive; they only prevent future sign-ins but do not remove the user from applications.
- ✓
Configure an Azure AD Access Review that reviews guest user access and automatically removes access after 90 days of inactivity.
Why this is correct
Access Reviews can be configured to run periodically (e.g., quarterly) and include only guest users. The review can be set to automatically remove users who do not respond or who are not approved, effectively removing access for inactive guests.
- ✗
Use Azure AD Identity Protection to detect guest user sign-in anomalies and revoke sessions.
Why it's wrong here
Azure AD Identity Protection is designed to detect risk flags such as anonymous IP addresses, unusual travel, or leaked credentials at authentication time, and it can respond by requiring MFA or blocking that specific sign-in. It does not track the last successful login date to identify users with 90 days of inactivity, and it cannot automatically redact or expire application assignments for dormant guest users. Its session revocation capability applies to confirmed compromised sessions, not to guests who simply no longer need access.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.