SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID (Azure AD). They have a cloud-based HR system (e.g., Workday) that contains employee records. They want to automate the process of creating user accounts in Microsoft Entra ID for new hires and deactivating accounts for terminated employees based on information from the HR system. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Many exam-takers confuse Microsoft Entra Connect (hybrid sync from on-prem AD) with HR-driven provisioning, but the question specifies a cloud-based HR system (Workday) with no on-premises AD involvement, making Application Provisioning the correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Application Provisioning
Microsoft Entra Application Provisioning (specifically HR-driven provisioning) is the correct feature because it automates the creation, update, and deactivation of user accounts in Microsoft Entra ID based on changes in an external HR system like Workday. It uses SCIM (System for Cross-domain Identity Management) protocol to synchronize employee lifecycle events from the HR source to Entra ID, enabling fully automated user provisioning without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Connect
Why it's wrong here
Microsoft Entra Connect is a specialized tool engineered to synchronize identity objects from an on-premises Active Directory Domain Services (AD DS) environment to Microsoft Entra ID. It is fundamental for hybrid identity scenarios, ensuring that users, groups, and contacts created and managed on-premises are accurately represented in the cloud. While crucial for hybrid environments, Microsoft Entra Connect does not directly integrate with cloud-based HR systems for automated user provisioning; its scope is limited to on-premises AD synchronization.
When this WOULD be correct
A company has an on-premises Active Directory and wants to synchronize user identities, passwords, and group memberships to Microsoft Entra ID for hybrid identity scenarios.
- ✓
Microsoft Entra Application Provisioning
Why this is correct
Microsoft Entra Application Provisioning is a robust feature designed to automate the end-to-end lifecycle management of user identities. It directly integrates with cloud-based Human Resources (HR) systems, such as Workday or SAP SuccessFactors, to automatically create, update, and delete user accounts in Microsoft Entra ID and connected SaaS applications. This automation streamlines onboarding and offboarding processes, ensuring that user access is consistently aligned with their employment status and reducing manual administrative overhead.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) empowers users to independently reset their forgotten passwords or unlock their accounts without requiring assistance from the IT help desk. This feature significantly reduces support overhead by providing a secure, self-service mechanism for common access issues. However, SSPR is strictly focused on password and account lockout management, and it does not facilitate the initial creation, modification, or deletion of user accounts within Microsoft Entra ID.
When this WOULD be correct
An exam question might ask: 'A company wants to allow users to reset their own passwords without help desk intervention. Which feature should they configure?' In that scenario, SSPR is the correct answer.
- ✗
Microsoft Entra Access Reviews
Why it's wrong here
Microsoft Entra Access Reviews provide a critical governance capability by enabling organizations to periodically review and certify user access to various resources, including groups, applications, and administrative roles. Its primary purpose is to ensure that access privileges remain appropriate and necessary over time, helping to mitigate the risk of excessive or stale permissions. This feature is focused on attestation and recertification of existing access, rather than the initial provisioning or de-provisioning of user identities themselves.
When this WOULD be correct
A company needs to periodically review and confirm that user access to critical applications is still appropriate, ensuring compliance and removing unnecessary permissions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Entra Application ProvisioningCorrect answer▾
Why this is correct
Microsoft Entra Application Provisioning is a robust feature designed to automate the end-to-end lifecycle management of user identities. It directly integrates with cloud-based Human Resources (HR) systems, such as Workday or SAP SuccessFactors, to automatically create, update, and delete user accounts in Microsoft Entra ID and connected SaaS applications. This automation streamlines onboarding and offboarding processes, ensuring that user access is consistently aligned with their employment status and reducing manual administrative overhead.
✗Microsoft Entra ConnectWrong answer — click to see why▾
Why this is wrong here
Microsoft Entra Connect is used for synchronizing on-premises Active Directory with Microsoft Entra ID, not for automating user provisioning from cloud HR systems like Workday.
★ When this WOULD be the correct answer
A company has an on-premises Active Directory and wants to synchronize user identities, passwords, and group memberships to Microsoft Entra ID for hybrid identity scenarios.
Why candidates choose this
Candidates may confuse 'synchronization' with 'provisioning' and think Entra Connect can handle HR-driven automation, but it is designed for on-premises AD sync, not cloud HR integration.
✗Self-Service Password Reset (SSPR)Wrong answer — click to see why▾
Why this is wrong here
Self-Service Password Reset (SSPR) allows users to reset their own passwords, but it does not automate the creation or deactivation of user accounts based on HR system data.
★ When this WOULD be the correct answer
An exam question might ask: 'A company wants to allow users to reset their own passwords without help desk intervention. Which feature should they configure?' In that scenario, SSPR is the correct answer.
Why candidates choose this
Candidates may confuse SSPR with provisioning because both involve user account lifecycle management, but SSPR focuses only on password reset, not account creation or deactivation.
✗Microsoft Entra Access ReviewsWrong answer — click to see why▾
Why this is wrong here
Access Reviews are used to review and certify existing access, not to automate the creation or deactivation of user accounts based on HR data.
★ When this WOULD be the correct answer
A company needs to periodically review and confirm that user access to critical applications is still appropriate, ensuring compliance and removing unnecessary permissions.
Why candidates choose this
Candidates may confuse the concept of managing user lifecycle (provisioning) with reviewing access rights, as both involve user account governance.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Provisioning
Provisioning is the process of setting up and configuring IT resources, such as user accounts, devices, or network services, so they are ready for use.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.