SC-300 Implement and Manage User Identities Practice Question
You are managing a hybrid environment with Microsoft Entra Connect. You need to ensure that when a user's account is disabled in the on-premises Active Directory, the corresponding cloud account is also disabled immediately. What is the default behavior of Entra Connect regarding account status?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The cloud account is disabled during the next delta synchronization cycle.
Synchronizing account status is a critical security control. If an employee leaves the company, their access must be revoked across all systems. Microsoft Entra Connect handles this by mapping the 'userAccountControl' attribute from on-premises to the 'accountEnabled' property in the cloud, ensuring that the cloud identity reflects the local administrative state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The cloud account is disabled during the next delta synchronization cycle.
Why this is correct
By default, Entra Connect synchronizes changes every 30 minutes. When a user is disabled on-premises, the 'userAccountControl' attribute change is detected during the next delta sync, and the sync engine updates the 'accountEnabled' attribute in Entra ID to 'false', effectively blocking the user from cloud resources.
- ✗
The cloud account remains enabled until the administrator manually runs a full synchronization.
Why it's wrong here
A full synchronization is not required for attribute changes like disabling an account. Delta synchronizations are designed to catch these specific updates. Relying on manual full syncs would introduce significant security delays and is not how the Entra Connect service is designed to operate in a production environment.
- ✗
The cloud account is immediately disabled via a real-time webhook call to Entra ID.
Why it's wrong here
Entra Connect does not use real-time webhooks for standard attribute synchronization. It relies on a scheduled polling mechanism (the sync cycle). While the delay is usually short (30 minutes), it is not instantaneous, which is an important distinction for administrators to understand when handling urgent terminations.
- ✗
The cloud account is deleted rather than disabled to save on license costs.
Why it's wrong here
Disabling an account on-premises only disables the cloud account; it does not delete it. This behavior is intentional, as it allows for the account to be re-enabled later if needed and preserves the user's data. To delete a cloud account, the on-premises object must be moved out of a synced OU.
About these practice questions
This SC-300 question is part of Courseiva's 17-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-300 exam.