AZ-500 Secure identity and access Practice Question
Your organization uses Microsoft Entra ID to manage access for employees and partners. You need to implement a solution that allows partners to self-service request access to specific applications, with approval from their manager, and access expires after 30 days. Which feature should you use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Entra B2B collaboration (which handles identity provisioning) with Entitlement Management (which handles the full lifecycle of access requests, approvals, and expiration), leading them to pick B2B collaboration as the answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Entitlement Management access packages
Entitlement Management access packages are designed to allow external partners to request access to specific applications through a self-service portal. The feature supports approval workflows (e.g., manager approval) and automatically enforces time-bound access, such as a 30-day expiration. This directly matches the requirement for partner self-service with approval and expiration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Entitlement Management access packages
Why this is correct
Entitlement Management access packages are the correct choice because they are specifically designed to govern end-user access to resources such as groups, applications, and SharePoint sites. These packages bundle resources with configurable policies for request approval, recurring access reviews, expiration, and automatic revocation when the policy ends. This enables self-service access requests while maintaining an auditable lifecycle for both internal and external users.
- ✗
Microsoft Entra B2B collaboration
Why it's wrong here
Microsoft Entra B2B collaboration focuses exclusively on inviting external guest users and enabling them to sign in to your tenant's resources. It handles identity federation and one-time invitation redemption, but it does not provide lifecycle management, approval workflows, or expiration policies for ongoing access. Thus, it is unsuitable when the requirement is full access governance rather than simply extending an invitation.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Privileged Identity Management (PIM) is scoped to time-boxed activation of elevated roles such as Microsoft Entra admin roles or Azure resource roles, requiring justification and multi-factor authentication. It does not manage regular users' access to business applications or group memberships through self-service requests or access reviews. Therefore, it is the wrong tool for general entitlement management of non-privileged resources.
- ✗
Conditional Access with session restrictions
Why it's wrong here
Conditional Access with session restrictions enforces security signals like sign-in risk, device compliance, or location, and can impose session controls such as sign-in frequency or app-enforced restrictions. It operates at runtime to restrict an existing authenticated session, but it does not proactively provision or assign access to resources. Since the question requires an access governance solution, session controls cannot deliver the necessary approval and expiration lifecycle.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.