SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The IT department wants to automatically assign a Microsoft 365 E5 license to all users in the Sales department based on their department attribute. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Many candidates confuse Administrative Units with Dynamic Groups, thinking that delegating admin control over a department also handles license assignment, but Administrative Units only manage administrative boundaries, not automated provisioning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Dynamic Groups
Dynamic Groups in Microsoft Entra ID allow automatic user membership based on user attributes, such as the department attribute. By creating a dynamic group rule like `user.department -eq "Sales"`, the system automatically assigns the group membership and can then apply a Microsoft 365 E5 license via group-based licensing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Dynamic Groups
Why this is correct
Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.
- ✗
Administrative Units
Why it's wrong here
Administrative Units (AUs) in Microsoft Entra ID provide a way to delegate administrative permissions over a specific subset of users, groups, or devices within an organization. For example, an AU can empower helpdesk staff to manage users only within a particular department or region. While AUs enable granular delegation, they do not possess any inherent functionality to automate the assignment or removal of licenses to users or groups.
When this WOULD be correct
A question asks: 'You need to delegate management of users in the Sales department to a junior admin, without giving them access to other departments. Which feature should you use?'
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is a security feature focused on detecting identity-based risks, such as compromised credentials, anomalous sign-ins, or risky user behaviors. It leverages machine learning to identify potential threats and can automate remediation actions, like requiring multi-factor authentication or password resets. While critical for security posture, Identity Protection's scope is entirely distinct from the administrative task of automating license assignment based on user attributes or group membership.
When this WOULD be correct
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or compromised credentials. Identity Protection would be the correct feature to configure risk-based conditional access policies.
- ✗
Access Reviews
Why it's wrong here
Microsoft Entra ID Access Reviews are a governance feature designed to periodically review and re-certify access to resources, such as group memberships or application assignments, by designated reviewers. Their primary function is to ensure that users maintain only the necessary access over time, reducing the risk of excessive permissions. This process focuses on auditing and validating existing access, rather than automatically provisioning or de-provisioning licenses based on user attributes.
When this WOULD be correct
A company needs to periodically verify that only Sales department users have access to a sensitive application. Access Reviews would be the correct feature to create a review campaign for that group.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Dynamic GroupsCorrect answer▾
Why this is correct
Microsoft Entra ID dynamic groups automatically manage membership based on defined attribute-based rules, such as a user's department or job title. When a user's attributes change, they are automatically added to or removed from the group, ensuring accurate membership. This capability is crucial for automating license assignment through group-based licensing, as licenses are then automatically provisioned or de-provisioned as users join or leave these dynamic groups.
✗Administrative UnitsWrong answer — click to see why▾
Why this is wrong here
Administrative Units are used to delegate administrative permissions over subsets of users, groups, or devices, not to automatically assign licenses based on attributes like department.
★ When this WOULD be the correct answer
A question asks: 'You need to delegate management of users in the Sales department to a junior admin, without giving them access to other departments. Which feature should you use?'
Why candidates choose this
Candidates may confuse Administrative Units with groups, thinking they can be used for license assignment or attribute-based membership, but they are solely for administrative scoping.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is a feature for detecting and responding to identity-based risks, not for automating license assignments based on user attributes.
★ When this WOULD be the correct answer
An organization wants to automatically detect and block sign-ins from anonymous IP addresses or compromised credentials. Identity Protection would be the correct feature to configure risk-based conditional access policies.
Why candidates choose this
Candidates may confuse Identity Protection with identity governance features, assuming it can manage user attributes or group memberships, due to the broad term 'identity' in its name.
✗Access ReviewsWrong answer — click to see why▾
Why this is wrong here
Access Reviews are used to review and certify user access rights periodically, not to automatically assign licenses based on attributes.
★ When this WOULD be the correct answer
A company needs to periodically verify that only Sales department users have access to a sensitive application. Access Reviews would be the correct feature to create a review campaign for that group.
Why candidates choose this
Candidates may confuse the concept of managing access (Access Reviews) with assigning licenses, as both involve user permissions and Entra ID features.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.