Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?
⚠ Common exam trap
Many exam-takers confuse Lifecycle workflows (which automate HR-driven provisioning events) with Entitlement management (which automates attribute-based access requests), leading them to choose Option A incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Entitlement management
Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Lifecycle workflows
Why it's wrong here
Lifecycle workflows are designed to automate HR-driven joiner-mover-leaver processes, such as automatically assigning licenses or deleting accounts when an employee's HR status changes. They are event-triggered and operate on lifecycle states (e.g., pre-hire, active, terminated), not on resource-specific attributes like department. They lack the ability to evaluate attribute values and dynamically grant access to a specific application's roles based on those attributes, so they cannot fulfill the requirement.
- ✓
Entitlement management
Why this is correct
Entitlement management in Microsoft Entra ID Governance provides access packages that bundle resources, roles, and policies. It can automate assignment based on member attributes through dynamic membership rules or by connecting to a source like an HR system, and it supports time-bound assignments, self-service requests, and approvals. This makes it the appropriate tool for automatically granting access to applications based on an attribute such as the user's department, aligning directly with the stated need.
- ✗
Access reviews
Why it's wrong here
Access reviews are a recertification control: they schedule recurring reviews for an administrator or delegated reviewer to confirm whether existing access should remain. They do not provision or grant access automatically based on attributes; they only validate and can revoke access that is not approved. Using access reviews would address ongoing compliance, but would never assign initial access based on department, so it is not the correct mechanism for this requirement.
- ✗
Privileged identity management
Why it's wrong here
Privileged Identity Management (PIM) is specifically for managing just-in-time privileged access to role-based administrative functions, such as Azure AD roles or Azure resource roles. It provides activation, approval, and time-limited elevation for users who are already eligible, but it does not handle standard (non-privileged) application access assignments. Since the requirement is about regular access to an application based on department attributes, PIM is not designed for or capable of that task.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.