MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
Your organization uses Microsoft Entra ID Governance. You need to automate the removal of access when an employee leaves the company. The identity lifecycle should trigger access reviews and automatic deprovisioning. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse Entitlement Management (which handles access packages) with Lifecycle Workflows (which handles the full lifecycle automation), or they think Access Reviews alone can automate deprovisioning, when in fact Access Reviews only provide attestation without execution of removal actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Lifecycle Workflows
Microsoft Entra Lifecycle Workflows is the correct choice because it is specifically designed to automate the entire identity lifecycle, including the removal of access when an employee leaves. It can trigger access reviews and automatically deprovision accounts and group memberships based on joiner, mover, and leaver scenarios, integrating with HR systems like Workday or SuccessFactors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Entitlement Management
Why it's wrong here
Microsoft Entra Entitlement Management is focused on creating and governing access packages that group apps, sites, and groups, with policies controlling assignments and time-limited expirations. However, it only governs the access package assignments themselves, not the complete joiner-mover-leaver lifecycle of a user identity. It does not react to HR-driven leave events to disable accounts or automatically deprovision non-package resources, so it cannot fulfill the requirement of automating end-to-end lifecycle deprovisioning.
- ✓
Microsoft Entra Lifecycle Workflows
Why this is correct
Microsoft Entra Lifecycle Workflows directly orchestrates joiner, mover, leaver, and post-arbitration workflows using built-in tasks arranged in a configurable schedule. For deprovisioning, it can trigger on an employee's leave date (for example, employeeLeaveDateTime) to disable the account, block sign-in, revoke sessions, remove licenses, and delete the user or send a manager email. Because it is event-driven by HR attributes and runs without manual intervention, it is the only option that automates the entire lifecycle from onboarding through offboarding.
- ✗
Microsoft Entra Access Reviews
Why it's wrong here
Microsoft Entra Access Reviews provides a recertification loop where designated reviewers must evaluate each user's continued need for access and either approve or deny it before any removal occurs. While you can automatically apply the review result to revoke a user's group or app assignment after the task ends, the process is inherently human-in-the-loop and not a real-time lifecycle deprovisioning task. It also does not handle account deletion or license removal changes for users leaving the organization independently of the review cycle.
- ✗
Microsoft Entra Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management is scoped solely to privileged identities, providing just-in-time, time-bound activation for Entra roles, Azure roles, and eligible memberships. It does not address ordinary user lifecycle events such as an employee's contract ending, and it has no built-in tasks for disabling standard accounts or stripping all resource access. Deprovisioning an employee's regular access is outside PIM's scope because it manages elevated admin roles rather than the entire identity lifecycle.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.