SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID and wants to ensure that guest users who are inactive for 90 days have their access to internal resources automatically revoked. Additionally, a manager must review all guest accounts annually. Which Microsoft Entra feature should be used to implement these requirements?
⚠ Common exam trap
It's easy for candidates to confuse Conditional Access policies with identity governance features, mistakenly thinking that Conditional Access can enforce inactivity-based revocation, when in fact it only controls access at sign-in time and cannot perform periodic reviews or automatic removal of stale accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Governance Access Reviews
Microsoft Entra Identity Governance Access Reviews enables administrators to create recurring reviews of guest user access and automatically remove access for inactive users. By configuring an access review with a duration of 90 days and enabling automatic revocation, guest users who have not signed in for that period will have their access removed. Additionally, the annual manager review requirement is met by scheduling a recurring review for all guest accounts, ensuring compliance with governance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Identity Governance Access Reviews
Why this is correct
Microsoft Entra Identity Governance Access Reviews enable organizations to manage the lifecycle of user access, particularly for guest accounts. They facilitate periodic reviews by resource owners or managers to certify continued access, ensuring compliance and security. These reviews can be automated to remove access for users who are not re-approved or have shown no activity for a defined period, directly addressing the need for guest account management and cleanup. This capability is crucial for maintaining a clean and secure identity posture by preventing stale accounts.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access policies enforce specific controls, such as multi-factor authentication or device compliance, at the time of access based on predefined conditions like user location, device state, or application. While essential for securing access, these policies are reactive controls that determine if and how a user can access resources, not who should have access or for how long. They lack the proactive review mechanisms and automated lifecycle management features required to periodically certify or remove guest accounts based on inactivity or lack of re-approval.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources within an organization, primarily by providing just-in-time (JIT) and time-bound access to privileged roles. Its core function is to reduce the exposure time of privileges and provide visibility into their use. PIM does not offer a mechanism for routine, periodic reviews of all guest user access to applications or resources, nor does it automate the removal of inactive guest accounts outside of privileged role assignments.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) empowers users to securely reset their own passwords without administrator intervention, reducing help desk calls and improving user productivity. This feature is solely focused on password management and recovery for existing user accounts. SSPR has no functionality related to reviewing user access permissions, managing the lifecycle of guest accounts, or automatically removing accounts based on inactivity or lack of re-approval. It addresses a completely different security and operational challenge.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Identity Governance
Identity Governance is the policy-based framework that ensures the right people have the right access to the right resources at the right time, with oversight and control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.