SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and needs to regularly review membership of a group that grants access to a sensitive HR application. The identity team wants to automate quarterly reviews and automatically remove users who fail to respond or are denied by the reviewer. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Many candidates confuse Privileged Identity Management (PIM) with Access Reviews because both involve 'reviews,' but PIM only handles role activation and approval workflows, not recurring group membership attestation with automatic removal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Reviews
Microsoft Entra Access Reviews are specifically designed to automate periodic attestation of group memberships, including the ability to automatically remove users who do not respond or are denied by the reviewer. This feature supports quarterly recurring reviews and integrates directly with Entra ID groups to enforce access governance for sensitive applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is a policy-based engine that enforces access decisions in real-time based on specific conditions. It evaluates factors like user location, device compliance, application being accessed, and sign-in risk to grant, block, or require multi-factor authentication. While crucial for security, Conditional Access is an enforcement tool that controls *how* users access resources, not a feature for conducting periodic reviews of *who* has access to group memberships or applications.
When this WOULD be correct
An exam question asking: 'A company needs to block access to a sensitive app from untrusted locations unless multi-factor authentication is used. Which feature should they configure?' would make Conditional Access the correct answer.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a security module focused on detecting and remediating identity-based risks. It leverages machine learning and heuristics to identify suspicious activities, such as impossible travel, leaked credentials, or unfamiliar sign-in properties, and can automatically block or challenge users. However, Identity Protection does not provide a mechanism for scheduled, human-driven reviews of group memberships or application access to ensure ongoing appropriateness of permissions.
When this WOULD be correct
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or users with leaked credentials, and require multi-factor authentication for high-risk sessions. Identity Protection would be the correct feature to configure risk-based policies.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It focuses on just-in-time (JIT) access and time-bound assignments for *privileged* roles and resources. While PIM includes access review capabilities, these are specifically for reviewing *privileged* role assignments and eligible access, not for routine reviews of general group memberships or application access for non-privileged users.
- ✓
Access Reviews
Why this is correct
Microsoft Entra Access Reviews provide a systematic way for organizations to manage access lifecycle by regularly reviewing who has access to various resources. This feature allows administrators to create recurring reviews for group memberships, application assignments, and Microsoft Entra role assignments. Reviewers, such as group owners or managers, can then approve or deny access, with the system automatically removing unresponsive or denied users based on configured settings, ensuring least privilege.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Access ReviewsCorrect answer▾
Why this is correct
Microsoft Entra Access Reviews provide a systematic way for organizations to manage access lifecycle by regularly reviewing who has access to various resources. This feature allows administrators to create recurring reviews for group memberships, application assignments, and Microsoft Entra role assignments. Reviewers, such as group owners or managers, can then approve or deny access, with the system automatically removing unresponsive or denied users based on configured settings, ensuring least privilege.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access is used to enforce access policies based on signals like user location or device state, not to automate review and removal of group memberships.
★ When this WOULD be the correct answer
An exam question asking: 'A company needs to block access to a sensitive app from untrusted locations unless multi-factor authentication is used. Which feature should they configure?' would make Conditional Access the correct answer.
Why candidates choose this
Candidates may confuse Conditional Access's policy enforcement with the review and remediation process, thinking it can automatically remove users based on policy violations.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to automate periodic membership reviews with removal of non-responding or denied users.
★ When this WOULD be the correct answer
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or users with leaked credentials, and require multi-factor authentication for high-risk sessions. Identity Protection would be the correct feature to configure risk-based policies.
Why candidates choose this
Candidates may confuse Identity Protection's automated risk remediation with the review and removal process, or think it includes user access governance features.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.