SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use HR-driven provisioning to populate an on-premises attribute and sync it

  Why it's wrong here

  This approach introduces unnecessary complexity for managing access based on the Manager attribute. HR-driven provisioning is primarily for automating user lifecycle management from an HR system into Entra ID, often involving initial user creation and attribute synchronization. While it can populate attributes, relying on an on-premises attribute and sync for dynamic group membership is indirect when Entra ID dynamic groups can directly leverage existing cloud-synced or cloud-native attributes like 'Manager' without additional on-premises provisioning steps specifically for this purpose.

• ✓

  Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy

  Why this is correct

  This is the most efficient and cloud-native solution. A dynamic group in Microsoft Entra ID can be configured with a rule (e.g., user.manager -ne null) to automatically include all users who have a manager assigned, ensuring membership is always up-to-date. This dynamic group can then be directly targeted by a Conditional Access policy, allowing granular control over application access or other security requirements for this specific user population.

• ✗

  Create an access package in Entitlement Management that requires manager approval

  Why it's wrong here

  Entitlement Management and access packages are designed for governing access requests and their lifecycle, not for automatically assigning users to groups based on attributes. An access package would require users to explicitly request access, which then undergoes an approval workflow, including manager approval. This process does not dynamically assign users to a group based on their existing Manager attribute, nor does it automatically grant access without a request.

• ✗

  Create an Administrative Unit for users with managers and assign the app to that unit

  Why it's wrong here

  Administrative Units (AUs) are used to scope administrative permissions within Microsoft Entra ID, allowing delegated administrators to manage only specific sets of users, groups, or devices. They are not a mechanism for defining dynamic user populations for access control or for directly assigning applications. While users can be members of AUs, AUs themselves do not function as security groups for application assignment or Conditional Access policy targeting.

Go deeper

Related to this question