SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The IT department needs to ensure that membership in the 'Global Administrator' role is regularly reviewed. Every quarter, the designated reviewers (e.g., senior managers) receive an email asking them to confirm whether each user in the role should keep their assignment. After the review deadline, any member not approved is automatically removed. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
It's easy for candidates to confuse Privileged Identity Management (PIM) with Access Reviews because both deal with privileged roles, but PIM handles activation and approval, while Access Reviews handle periodic attestation and removal of stale assignments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Reviews
Access Reviews in Microsoft Entra ID are specifically designed for periodic attestation of group memberships, application access, and role assignments. The scenario describes a quarterly review where designated reviewers receive email notifications and unapproved members are automatically removed after the deadline, which is the exact workflow that Access Reviews automate. This feature ensures compliance by requiring explicit confirmation for each user in the Global Administrator role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Access Reviews
Why this is correct
Microsoft Entra ID Access Reviews enable organizations to efficiently manage group memberships, access to applications, and role assignments by creating recurring review campaigns. These campaigns empower designated reviewers, often resource owners, to periodically attest to the continued need for access for each member. Upon completion of the review period, Access Reviews can automatically remove users whose access was not approved, ensuring the principle of least privilege and reducing stale access. This directly addresses the need for periodic review and removal of access.
- ✗
Privileged Identity Management (PIM)
Why it's wrong here
PIM provides time-bound and approved activation of privileged roles, but it does not natively automate periodic reviews and removal of non-approved members without also using Access Reviews. The scenario describes a review process, which is a core feature of Access Reviews.
When this WOULD be correct
PIM would be correct if the question asked: 'The IT department needs to allow users to request temporary elevation to the Global Administrator role, with approval from senior managers and automatic expiration after a set time.'
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a security tool focused on detecting and remediating identity-based risks, such as suspicious sign-in activities, leaked credentials, or compromised user accounts. It leverages machine learning to identify anomalies and can automatically block or challenge risky sign-ins and users. While crucial for security, Identity Protection does not offer functionality for periodic review of group memberships or role assignments, nor does it automate the removal of unapproved access based on such reviews. Its scope is real-time risk detection and response, not access governance.
When this WOULD be correct
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or locations with atypical travel patterns, and require multi-factor authentication for high-risk users.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra ID Conditional Access is a policy engine that evaluates specific conditions at the time a user attempts to sign in to a resource. It enforces access decisions, such as requiring multi-factor authentication, blocking access from untrusted locations, or mandating compliant devices, based on various signals. However, Conditional Access policies are reactive to sign-in events and do not provide a mechanism for proactively reviewing or automatically removing existing group memberships or role assignments on a recurring basis. It controls *how* access is granted, not *who* has access over time.
When this WOULD be correct
A company wants to require that all users accessing a sensitive application from outside the corporate network must use multi-factor authentication. They need a policy that evaluates conditions (e.g., location, device compliance) and grants or blocks access accordingly.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Access ReviewsCorrect answer▾
Why this is correct
Microsoft Entra ID Access Reviews enable organizations to efficiently manage group memberships, access to applications, and role assignments by creating recurring review campaigns. These campaigns empower designated reviewers, often resource owners, to periodically attest to the continued need for access for each member. Upon completion of the review period, Access Reviews can automatically remove users whose access was not approved, ensuring the principle of least privilege and reducing stale access. This directly addresses the need for periodic review and removal of access.
✗Privileged Identity Management (PIM)Wrong answer — click to see why▾
Why this is wrong here
PIM provides just-in-time privileged access and activation workflows, but it does not include the recurring review and automatic removal process described. The question specifically requires periodic reviews with automatic removal, which is a core feature of Access Reviews, not PIM.
★ When this WOULD be the correct answer
PIM would be correct if the question asked: 'The IT department needs to allow users to request temporary elevation to the Global Administrator role, with approval from senior managers and automatic expiration after a set time.'
Why candidates choose this
Candidates often confuse PIM with Access Reviews because both are part of Microsoft Entra ID Governance and involve privileged roles. PIM includes review capabilities, but the question's emphasis on recurring reviews and automatic removal points specifically to Access Reviews.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is designed to detect and remediate identity-based risks (e.g., compromised accounts, risky sign-ins), not to manage periodic review and removal of role assignments.
★ When this WOULD be the correct answer
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or locations with atypical travel patterns, and require multi-factor authentication for high-risk users.
Why candidates choose this
Candidates may confuse 'reviewing role membership' with 'protecting identities' because both involve security oversight, but Identity Protection focuses on risk detection, not role governance.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access is used to enforce access controls based on conditions like location or device state, not for reviewing and attesting role memberships. The question specifically requires a review and attestation process, which is handled by Access Reviews.
★ When this WOULD be the correct answer
A company wants to require that all users accessing a sensitive application from outside the corporate network must use multi-factor authentication. They need a policy that evaluates conditions (e.g., location, device compliance) and grants or blocks access accordingly.
Why candidates choose this
Candidates may confuse Conditional Access with access governance features, thinking it can be used to review role assignments, but it is actually a policy engine for enforcing access requirements.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.