SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.

  Why this is correct

  Creating an access package with a connected organization is the optimal solution as it fully leverages Microsoft Entra ID Identity Governance capabilities. This approach allows the organization to define a self-service workflow for external partners from a specific domain, ensuring that access to the application is granted only after an approval process. The access package also enforces a 30-day expiration, automatically revoking access, and mandates a quarterly access review to continuously validate the necessity of ongoing access, thereby meeting all specified security and compliance requirements comprehensively.

• ✗

  Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

  Why it's wrong here

  This option correctly utilizes an access package with a connected organization, approval, and expiration, which addresses several key requirements for managing external partner access to an application. However, it critically omits the crucial component of a quarterly access review. Without an ongoing access review policy, there is no automated mechanism to periodically re-evaluate whether the partner's access is still necessary or appropriate, failing to meet the continuous governance and compliance needs of the organization.

• ✗

  Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

  Why it's wrong here

  Creating a dynamic group based on a partner's email domain can automate group membership, but it falls short of the comprehensive governance requirements for external partner access. Dynamic groups do not natively support an approval workflow for initial access requests, nor do they provide a mechanism for individual access expiration tied to the group membership or integrated access reviews for validating ongoing access. This method lacks the granular control and lifecycle management capabilities required for secure external collaboration.

• ✗

  Add the partner as a guest user manually and assign the application directly with an expiration date.

  Why it's wrong here

  Manually adding a partner as a guest user and assigning an application directly, even with an expiration date, is an inefficient and ungoverned approach for managing external access. This method lacks any automated approval workflow for initial access requests, making it prone to errors and inconsistent application of policy. Furthermore, it does not incorporate a structured access review process to periodically re-evaluate the necessity of access, failing to meet the scalability, auditability, and compliance requirements for partner collaboration.

Go deeper

Related to this question