MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Which TWO actions can you perform using Microsoft Entra ID Governance? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse general Entra ID features (like SSO and role delegation) with the specific governance capabilities of Entra ID Governance, which focuses on access lifecycle, reviews, and entitlement management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automate user access reviews
Microsoft Entra ID Governance includes automated user access reviews, which allow organizations to periodically certify that users still need access to applications, groups, and roles. These reviews can be scheduled, recurring, and delegated to reviewers, with automated actions like removing access when a reviewer does not respond. This directly supports compliance and least-privilege principles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manage device compliance policies
Why it's wrong here
Device compliance policies are created and managed in Microsoft Intune, not Microsoft Entra ID. While Entra ID can evaluate device compliance status as a condition for Conditional Access, the policy definition, assignment, and enforcement are Intune responsibilities. Governance in Entra ID centers on identity and access lifecycle, not device configuration, so this action is outside the scope of Entra ID Governance.
- ✓
Automate user access reviews
Why this is correct
Automating user access reviews is a core feature of Microsoft Entra ID Governance, allowing organizations to schedule recurring attestation for access to groups, applications, and roles. Reviews can include automatic reminders and apply decisions like removing dormant access when a reviewer does not act. This transforms a manual audit process into an ongoing control, ensuring access remains appropriate and compliant over time.
- ✗
Configure single sign-on for SaaS apps
Why it's wrong here
Configuring single sign-on for SaaS apps is an authentication capability of Microsoft Entra ID, typically using SAML or OpenID Connect to federate identities. While identity governance manages the right of access, SSO simply enables a seamless login experience after access has been granted. Therefore, SSO configuration is part of the enterprise application and identity management layer, not a governance action.
- ✗
Delegate administrative roles
Why it's wrong here
Delegating administrative roles in Entra ID is an identity administration task that relies on role-based access control (RBAC) to grant permissions to IT staff. This action manages who controls identity settings, but it does not directly govern end-user access to resources. Governance focuses on certifying and approving access via workflows, whereas role delegation is about operational administration, making it an incorrect answer here.
- ✓
Manage entitlement management
Why this is correct
Managing entitlement management is a key feature of Microsoft Entra ID Governance, enabling the creation of access packages for groups, apps, and sites. Administrators define policies for requesting access, multi-stage approvals, and time-based expiration, allowing automated provisioning and deprovisioning. This directly enforces the principle of least privilege across the identity lifecycle, making it a quintessential governance action.
Go deeper
Related to this question
Learn chapter
Entra Connect Sync Rules and Filtering
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.