SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The IT team needs to ensure that when employees leave the organization, their access to all Microsoft 365 applications is revoked immediately and their account is disabled. Which Microsoft Entra capability should the team use?
⚠ Common exam trap
The trap here is assuming that Conditional Access or PIM can fully handle offboarding, but they lack the automation to disable accounts and revoke all access immediately upon termination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Governance lifecycle workflows
Lifecycle workflows in Microsoft Entra ID Governance are designed to automate identity lifecycle tasks, including offboarding. When an employee leaves, a leaver workflow can immediately disable the account and remove access to all integrated applications, ensuring compliance and security. Other options do not provide this end-to-end automation for termination scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Governance lifecycle workflows
Why this is correct
Lifecycle workflows in Microsoft Entra ID Governance automate joiner, mover, and leaver processes. For a leaver, you can configure a workflow that disables the account and revokes access to all applications immediately upon triggering. This directly addresses the requirement by automating offboarding tasks, ensuring no residual access remains. It is the correct capability for this scenario.
- ✗
Microsoft Entra Conditional Access policies
Why it's wrong here
Conditional Access policies evaluate sign-in conditions to grant or block access, but they do not disable accounts or revoke existing sessions and application access for terminated users. They are preventive controls at sign-in, not lifecycle management tools. While you could block sign-ins, the account would remain enabled and existing tokens might still be valid, failing the immediate revocation requirement.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
PIM manages just-in-time privileged role activation and access reviews, but it does not directly disable user accounts or revoke all application access upon termination. While PIM can help with role assignments, it is not the primary tool for offboarding. The scenario requires immediate account disablement and access revocation, which is outside PIM's core purpose.
- ✗
Microsoft Entra self-service password reset (SSPR)
Why it's wrong here
SSPR allows users to reset their own passwords, which is unrelated to revoking access for departing employees. It does not disable accounts or remove application access. This feature is designed for convenience and reducing helpdesk calls, not for offboarding. Using SSPR would not meet the requirement of immediate revocation of access upon termination.
Go deeper
Related to this question
Learn chapter
Cross-Tenant Access Settings
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.