SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID (Microsoft Entra ID) to manage access to internal applications for employees and guest users. The compliance team requires that all guest users' access to a sensitive application must be reviewed every 90 days by the application owner. If the owner does not respond to the review request, the guest's access must be automatically revoked. Which Microsoft Entra ID feature should the company use?
⚠ Common exam trap
Many candidates confuse Access Reviews with Privileged Identity Management (PIM), since both involve approvals and time-bound access, but PIM focuses on privileged role activation while Access Reviews handle recurring attestation of any user's access to resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Reviews
Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest user access to applications, groups, or roles. The scenario requires a 90-day review cycle with automatic revocation if the owner does not respond, which is a built-in configuration option within an Access Review policy. This directly meets the compliance team's requirement for periodic attestation and automated removal of access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra ID Conditional Access policies evaluate specific signals like user, device, location, and application to make real-time access decisions (e.g., grant, block, require MFA). While it enforces *how* access is granted or restricted *at the time of access*, it does not provide a mechanism for periodic review of *who* has access to *what*, nor does it automatically remove access based on a review outcome or lack of response. Its focus is on session-time policy enforcement, not ongoing access governance.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a security tool focused on detecting and remediating identity-based risks, such as compromised credentials, anomalous sign-ins, or risky users. It uses machine learning to identify suspicious activities and can trigger automated responses like blocking access or requiring password changes. However, its primary function is risk detection and response, not the systematic, periodic review and recertification of existing access assignments for compliance or least privilege principles.
- ✓
Access Reviews
Why this is correct
Microsoft Entra ID Access Reviews are specifically designed to manage and streamline the periodic review of user access to resources like groups, applications, and roles. Administrators can configure recurring reviews, assign reviewers (e.g., resource owners, managers), and set up automated actions, such as removing access for users whose access is not approved or if the reviewer fails to respond within a specified timeframe. This capability directly addresses the need for periodic recertification and automated removal.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra ID Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important organizational resources, primarily by providing just-in-time (JIT) access to privileged roles and resources. It allows for time-bound access, approval workflows, and multi-factor authentication for activation, reducing the attack surface of standing privileged access. While PIM does include access reviews for *privileged* roles, its core purpose is elevating and managing *privileged* access, not the broad, periodic recertification of *all* user access to groups or applications as implied by the question.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.