MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Your company is implementing a Microsoft Entra ID Governance solution. You need to ensure that access reviews are performed for all guest users in the Finance department. The review must be conducted by the guest user's manager. Which THREE actions should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an access review for the dynamic group with scope 'All guest users'.
A review of groups with guest members, creation of an access review for all guests in Finance, and assignment of reviewers to managers are required. Setting a self-review is not correct because the requirement is for manager review. Disabling automatic application of results is unnecessary and could prevent enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the 'Auto apply results to resource' setting.
Why it's wrong here
Disabling 'Auto apply results to resource' would leave access decisions unenforced until a manual step is taken to apply them. In an access review, the auto-apply setting automatically removes or keeps access for each reviewed user based on the reviewer's decision; without it, denied guest users could continue accessing Finance resources indefinitely. Because the goal is to revoke unnecessary access, this setting must be enabled, not disabled.
- ✓
Create an access review for the dynamic group with scope 'All guest users'.
Why this is correct
An access review must be attached to a concrete resource; here, the dynamic group of Finance guest users is that resource. By setting the review scope to 'All guest users', every member of that group is evaluated, regardless of when they were added. This ensures the review covers the exact population the business wants to recertify, rather than a static snapshot or a broader tenant-wide set.
- ✓
Configure the access review to have reviewers be the guest user's manager.
Why this is correct
The requirement explicitly calls for each guest user's access to be reviewed by that user's manager, so the access review must assign the 'Manager' reviewer type. When this setting is used, each reviewer is automatically matched to the manager attribute of the guest user they are asked to evaluate. Choosing any other reviewer, such as group owners or a selection of specific users, would not fulfill the stated approval chain.
- ✗
Set the access review to self-review for guest users.
Why it's wrong here
Self-review asks the guest user to decide whether they should keep access, which is the opposite of a manager-driven recertification. Guests are likely to approve their own access without considering business need or security risk, and a manager review is specifically intended to provide independent, authoritative control. Because the requirement mandates manager review, selecting self-review is incorrect.
- ✓
Create a dynamic group containing all guest users from the Finance department.
Why this is correct
A dynamic group with a rule such as (user.department -eq "Finance") and (user.userType -eq "Guest") is necessary to automatically gather the correct guest users into one reviewable collection. Dynamic group membership is recalculated continuously, so the access review will always reflect current users who meet those criteria at the time the review runs. This group is the fundamental target resource on which the access review is then created.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Access review
An access review is a periodic audit process where administrators check and confirm which users have permissions to what resources, ensuring only authorized people retain access.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.