SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Ask HR to manually disable each user in Microsoft Entra ID after termination.

  Why it's wrong here

  Asking HR to manually disable users is highly inefficient and prone to human error, especially in larger organizations. This approach lacks the necessary automation to ensure consistent and timely deactivation of accounts, making it extremely difficult to meet a strict security requirement like revoking access within 24 hours of an HR status change. Manual processes also create auditability challenges and increase the risk of orphaned accounts, posing significant security vulnerabilities.

• ✓

  Configure Microsoft Entra ID provisioning from Workday to automatically disable users when their employment status changes.

  Why this is correct

  Configuring Microsoft Entra ID provisioning from Workday leverages Workday as the authoritative system of record for employee status. This automated, event-driven integration uses the SCIM protocol to automatically update user accounts in Entra ID, including disabling them, immediately upon a status change in Workday. This ensures timely and accurate deprovisioning, consistently meeting the 24-hour requirement for access revocation and enhancing overall security and compliance.

• ✗

  Use Microsoft Graph API to write a custom application that polls Workday and disables users.

  Why it's wrong here

  Developing a custom application using Microsoft Graph API to poll Workday introduces unnecessary complexity and maintenance overhead. While technically feasible, this approach requires significant development resources, ongoing support, and custom error handling, effectively reinventing functionality already robustly provided by Microsoft Entra ID's built-in HR-driven provisioning capabilities. Such a custom solution would also likely be less resilient, secure, and cost-effective than a native integration.

• ✗

  Create an Azure Automation runbook that runs daily and checks Workday for terminated employees, then disables them in Entra ID.

  Why it's wrong here

  An Azure Automation runbook running daily would introduce a delay of up to 24 hours from the run time, failing the requirement that revocation occurs automatically within 24 hours of the HR status change. This option is tempting because runbooks are commonly used for scheduled, scripted remediation tasks in hybrid environments, and would be correct if the requirement allowed a daily batch check rather than event-driven, near-real-time provisioning.

Go deeper

Related to this question