SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company has many guest users in Microsoft Entra ID who collaborate on a project in a specific SharePoint site. The compliance team needs to periodically verify that these guest users still require access to the site. If a reviewer does not respond within 30 days, the guest's access should be automatically removed. Additionally, the company wants to ensure that once access is removed, the guest user object is eventually deleted from the directory after 90 days. Which Microsoft Entra Identity Governance features should they use together?
⚠ Common exam trap
Watch out — candidates often confuse 'removing access' (which many features can do) with 'deleting the user object from the directory' (which only Access Reviews with the specific deletion setting can do), leading them to choose Entitlement Management or Lifecycle Workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access Reviews configured to auto-apply results and delete guest users after a specified number of days
Access Reviews in Microsoft Entra ID can be configured to automatically apply results, removing guest access when a reviewer does not respond within a specified period (e.g., 30 days). Additionally, the 'Delete guest users not reviewed within' setting allows automatic deletion of the guest user object from the directory after a configurable number of days (e.g., 90 days). This directly meets both requirements: periodic verification of access and eventual cleanup of the directory object.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Access Reviews configured to auto-apply results and delete guest users after a specified number of days
Why this is correct
Access Reviews are specifically designed for periodically reviewing user access to resources, including guest users. By configuring an Access Review to auto-apply results, access can be automatically revoked if reviewers do not respond or deny access. Crucially, the 'Delete users' setting within the review can be enabled to automatically remove guest user objects from Microsoft Entra ID after a specified number of days if their access is denied or not re-certified, directly addressing the need for automated guest cleanup.
- ✗
Entitlement Management access packages with an expiration policy
Why it's wrong here
Entitlement Management access packages are effective for managing initial access requests and providing time-bound access to resources for guest users. While an expiration policy can automatically remove a guest user's access to the resources within an access package, it does not inherently provide a mechanism for periodic re-validation of their *continued need* for access or automatically delete the guest user object from the directory itself. This solution focuses on provisioning and expiring access, not ongoing review and identity lifecycle management for existing guests.
- ✗
Lifecycle Workflows to schedule a periodic task
Why it's wrong here
Lifecycle Workflows automate tasks around specific identity lifecycle events, such as when a user joins, moves within, or leaves an organization. These workflows are event-driven and are not primarily designed for periodic assessment of *ongoing* access needs for existing guest users or for automatically deleting guest accounts based on lack of activity or review. While custom tasks could potentially be built, Lifecycle Workflows are not the native or most efficient solution for recurring access reviews and guest identity cleanup.
- ✗
Privileged Identity Management (PIM) for guest roles
Why it's wrong here
Privileged Identity Management (PIM) is a tool focused on managing, controlling, and monitoring access to important resources by providing just-in-time (JIT) access to privileged roles. It is designed for elevating access to administrative roles or Azure resources for a limited time, not for the periodic review of standard, non-privileged collaboration access for general guest users. PIM does not offer the functionality to periodically review and automatically delete guest user objects based on their ongoing need for general collaboration access.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Guest access
Guest access allows a user to temporarily connect to a network, application, or shared resource with limited permissions, without being a permanent member of the organization.
Key term
Identity Governance
Identity Governance is the policy-based framework that ensures the right people have the right access to the right resources at the right time, with oversight and control.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.