SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and wants to automate the lifecycle of guest users. When a contractor's project ends, the guest account should be automatically blocked and then removed after 30 days. Which Microsoft Entra capability should they configure to manage this process?
⚠ Common exam trap
Many exam-takers confuse the broad category 'Identity Governance' (Option D) with the specific feature 'Entitlement Management' (Option B), but the question asks for the capability that directly configures the automated lifecycle, which is Entitlement Management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Entitlement Management
Entitlement Management in Microsoft Entra ID Governance allows organizations to automate the lifecycle of external identities, including guest users. By configuring an access package with a specific expiration policy (e.g., 30 days after project end), the system can automatically block and then remove the guest account when the entitlement expires, without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies are powerful tools that enforce access controls based on real-time conditions during a sign-in attempt. They can block access, require multi-factor authentication, or enforce device compliance, but they operate *after* an account exists and tries to authenticate. Conditional Access does not possess the functionality to provision, deprovision, or manage the lifecycle of guest accounts by automatically creating them or removing them based on predefined project end dates.
- ✓
Entitlement Management
Why this is correct
Entitlement Management, a core component of Microsoft Entra Identity Governance, is specifically designed to automate the lifecycle of access for both internal and external users. It allows organizations to define access packages that bundle resources and specify access policies, including start and end dates. When an access package expires, Entitlement Management automatically revokes access and can remove guest accounts from the directory, directly addressing the requirement for automated guest account creation and removal tied to project timelines.
- ✗
Privileged Identity Management
Why it's wrong here
Privileged Identity Management (PIM) focuses on securing and managing access to privileged roles and resources within Microsoft Entra ID and Azure. Its primary purpose is to provide just-in-time (JIT) and just-enough-access (JEA) for elevated permissions, requiring users to activate roles for a limited time. PIM is not designed for the general lifecycle management of standard guest accounts, nor does it automate their creation or removal based on project end dates; it's about controlling *who* can perform *privileged actions*.
- ✗
Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance is a comprehensive umbrella term encompassing a suite of capabilities, including Entitlement Management, Access Reviews, and Privileged Identity Management. Its overarching goal is to ensure appropriate access throughout the identity lifecycle. While Entitlement Management, the correct solution, falls under Identity Governance, selecting the broader category is less precise than identifying the specific service that directly fulfills the requirement of automating guest account lifecycle based on project end dates.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.