SC-900 Describe the capabilities of Microsoft Entra Practice Question
You are configuring Microsoft Entra ID Governance. You need to ensure that when a user leaves the organization, their access to all SaaS applications is automatically revoked. Which Microsoft Entra feature should you use?
⚠ Common exam trap
Candidates often confuse Conditional Access (which controls access during authentication) with lifecycle management features like Access Reviews, which handle ongoing governance and automatic removal of access after a user leaves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Access Reviews
Microsoft Entra Access Reviews allows administrators to create recurring reviews of user access to SaaS applications. When a user leaves the organization, an automated access review can be configured to remove their access based on the review results, ensuring revocation of access to all assigned SaaS apps. This directly addresses the requirement for automatic revocation upon departure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies define *when* and *how* users can access resources based on specific conditions like user risk, device compliance, or location. While it can block access for disabled accounts or enforce multi-factor authentication, Conditional Access does not provide a mechanism for *automatically revoking* previously assigned application access or group memberships when a user's employment status changes or their account is merely inactive, rather than disabled. Its primary function is policy enforcement at the point of access.
- ✗
Microsoft Entra Privileged Identity Management (PIM)
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to *privileged roles* within Microsoft Entra ID, Azure resources, and other Microsoft services. PIM enables just-in-time access, approval workflows, and access reviews for these elevated permissions. However, PIM does not manage the lifecycle of *general application access* or regular group memberships for all users, which is the broader scope implied by general access revocation needs.
- ✓
Microsoft Entra Access Reviews
Why this is correct
Microsoft Entra Access Reviews are a fundamental capability within Microsoft Entra ID Governance that allows organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments. They enable administrators or business owners to regularly review who has access to what, and crucially, to automatically remove access for users who no longer need it, especially when their accounts are disabled or they leave the organization, thereby enforcing least privilege and compliance.
- ✗
Microsoft Entra Terms of Use
Why it's wrong here
Microsoft Entra Terms of Use are utilized to present information to users, such as legal disclaimers or acceptable use policies, requiring their acceptance before they can access protected resources. This ensures users acknowledge specific agreements or policies. However, Terms of Use are a consent mechanism and do not offer any functionality for automatically reviewing, managing, or revoking existing access assignments to applications or groups based on user lifecycle events or inactivity.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Access review
An access review is a periodic audit process where administrators check and confirm which users have permissions to what resources, ensuring only authorized people retain access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.