SC-100 Practice Question: Design security operations, identity, and compliance capabilities
A software company uses Microsoft 365 E5 and wants to ensure that when an employee is terminated, their access to all Microsoft Entra ID integrated applications is removed immediately and their manager is notified to reassign their files. The company wants to automate this without manual intervention from the IT help desk. Which Microsoft Entra ID Governance feature should you design into the solution?
⚠ Common exam trap
The trap here is choosing access reviews for termination, when reviews are periodic certification cycles rather than event-driven leaver automation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lifecycle workflows that run a leaver task on the employee's last day
The scenario calls for automated, event-driven removal of access plus manager notification at termination. Lifecycle workflows in Microsoft Entra ID Governance are built for exactly this leaver pattern, running tasks such as disabling the account, removing assignments, and sending notifications. Access reviews are periodic and manual, conditional access governs authentication conditions, and Privileged Identity Management governs privileged role activation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access reviews that require managers to certify their team's group memberships quarterly
Why it's wrong here
Access reviews are periodic certification cycles, typically quarterly or annually, and they depend on a reviewer taking action. They cannot revoke access immediately on a termination date and they do not send a reassignment notification to a manager. The delay between cycles and the manual reviewer step fail the immediate, automated requirement.
- ✓
Lifecycle workflows that run a leaver task on the employee's last day
Why this is correct
Lifecycle workflows in Microsoft Entra ID Governance automate joiner, mover, and leaver tasks based on events or schedules. A leaver workflow can disable the account, remove group and application assignments, and send notifications to the manager, which matches the requirement to revoke access immediately and notify the manager without help desk involvement.
- ✗
Conditional Access policies that block sign-ins from unmanaged devices
Why it's wrong here
Conditional Access controls the conditions under which a user can authenticate, such as device compliance or location. It is not tied to an HR termination event, does not remove application assignments, and does not notify a manager. Blocking unmanaged devices also has no relationship to revoking a terminated employee's access.
- ✗
Privileged Identity Management to make all application roles eligible rather than active
Why it's wrong here
Privileged Identity Management governs just-in-time activation of privileged roles and requires users to activate roles with justification and possibly approval. It does not handle standard application access removal on termination, does not run on a leaver schedule, and does not notify managers about file reassignment, so it does not fit this scenario.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.