SC-900 Describe the capabilities of Microsoft Entra Practice Question
A multinational corporation uses Microsoft Entra ID. The IT department wants to allow regional IT administrators in Europe to manage users and groups only for their own region, without granting them permissions to manage users in other regions. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Test-takers frequently confuse Privileged Identity Management (PIM) with scope delegation, not realizing that PIM controls when a role is activated, not where it can be applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B. Administrative Units
Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to a subset of users, groups, or devices. By creating an AU for the Europe region and assigning regional IT administrators to it, you restrict their management scope to only those objects within that AU, preventing them from managing users in other regions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A. Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is a policy-based engine that evaluates various signals, such as user location, device compliance, application, and sign-in risk, to make real-time access decisions. It enforces specific controls like multi-factor authentication, device compliance, or blocking access entirely, based on predefined conditions. While fundamental for securing access to resources by enforcing access policies, Conditional Access is an access enforcement tool, not a mechanism for delegating administrative authority or scoping administrative roles to specific organizational units or subsets of users.
When this WOULD be correct
A question asks: 'A company wants to require multi-factor authentication for all users accessing a sensitive app from outside the corporate network. Which feature should they use?'
- ✓
B. Administrative Units
Why this is correct
Administrative Units (AUs) in Microsoft Entra ID are designed to enable granular delegation of administrative responsibilities by allowing an organization to logically group a subset of users, groups, or devices. This feature is crucial for large enterprises or multinational corporations that need to assign specific administrative roles, such as User Administrator or Group Administrator, to regional IT staff. By scoping these roles to an AU, administrators can manage objects strictly confined to their assigned unit, preventing over-privileging and enhancing security.
- ✗
C. Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is a service designed to manage, control, and monitor access to important resources in Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) and just-enough-access (JEA) capabilities by allowing users to activate eligible roles for a limited time, thereby reducing the exposure window of privileged permissions. While PIM significantly enhances security by managing the lifecycle of privileged role assignments, it focuses on elevating existing role assignments temporarily, not on defining or delegating administrative scope over specific subsets of users or devices within the directory.
When this WOULD be correct
A question asks: 'The IT department wants to provide just-in-time access for administrators to manage user accounts, requiring approval for role activation and limiting the duration of elevated privileges. Which feature should they use?' In that scenario, Privileged Identity Management is the correct answer.
- ✗
D. Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance provides capabilities for managing and auditing identity and access lifecycles, including features like access reviews, entitlement management, and privileged identity management. Its primary purpose is to ensure that the right people have the right access to the right resources at the right time, and to remove that access when it's no longer needed. While vital for security and compliance, Identity Governance focuses on managing user access to resources and privileged role assignments, rather than defining and delegating administrative scope over subsets of directory objects.
When this WOULD be correct
An exam question asks: 'A company needs to automate the review and certification of access rights for users in a specific department every quarter. Which Microsoft Entra ID feature should they use?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓B. Administrative UnitsCorrect answer▾
Why this is correct
Administrative Units (AUs) in Microsoft Entra ID are designed to enable granular delegation of administrative responsibilities by allowing an organization to logically group a subset of users, groups, or devices. This feature is crucial for large enterprises or multinational corporations that need to assign specific administrative roles, such as User Administrator or Group Administrator, to regional IT staff. By scoping these roles to an AU, administrators can manage objects strictly confined to their assigned unit, preventing over-privileging and enhancing security.
✗A. Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access is used to enforce access controls based on conditions like location or device state, not to delegate administrative permissions over specific subsets of users or groups.
★ When this WOULD be the correct answer
A question asks: 'A company wants to require multi-factor authentication for all users accessing a sensitive app from outside the corporate network. Which feature should they use?'
Why candidates choose this
Candidates may confuse the 'regional' restriction in the question with location-based policies, which is a common use of Conditional Access, but the requirement is about administrative delegation, not access control.
✗C. Privileged Identity ManagementWrong answer — click to see why▾
Why this is wrong here
Privileged Identity Management (PIM) provides time-based and approval-based role activation to manage privileged access, but it does not restrict administrative scope to specific regions or organizational boundaries. It cannot limit user/group management to a subset of users based on geography.
★ When this WOULD be the correct answer
A question asks: 'The IT department wants to provide just-in-time access for administrators to manage user accounts, requiring approval for role activation and limiting the duration of elevated privileges. Which feature should they use?' In that scenario, Privileged Identity Management is the correct answer.
Why candidates choose this
Candidates may confuse PIM's role-based access control with the ability to scope permissions, or they may think that activating a role via PIM can be restricted to certain regions, which is not the case.
✗D. Identity GovernanceWrong answer — click to see why▾
Why this is wrong here
Identity Governance focuses on managing user access rights, certifications, and lifecycle, not on delegating administrative permissions to manage users and groups within specific boundaries like regions.
★ When this WOULD be the correct answer
An exam question asks: 'A company needs to automate the review and certification of access rights for users in a specific department every quarter. Which Microsoft Entra ID feature should they use?'
Why candidates choose this
Candidates may confuse Identity Governance with administrative delegation because both involve managing user permissions, but Identity Governance is about access reviews and entitlements, not scoped admin roles.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Scope
In IT, scope defines the boundaries, goals, and deliverables of a project, assessment, or engagement, specifying what is included and what is excluded.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.