SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID Governance. You need to ensure that access to a critical application is reviewed every 90 days by the application owner. If the review is not completed, access should be revoked automatically. Which feature should you configure?
⚠ Common exam trap
Test-takers frequently confuse Entitlement management (which handles access packages and lifecycle) with Access reviews (which specifically handle recurring attestation and automatic revocation), leading them to pick D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access reviews
Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group memberships or application assignments, with automatic revocation of access if the review is not completed. By configuring a review every 90 days and setting the 'Auto apply' action to 'Remove access', you ensure that the application owner must certify access or it is automatically revoked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terms of use
Why it's wrong here
Microsoft Entra ID Terms of Use (ToU) are designed to present information to users and require their explicit acceptance before accessing resources. While crucial for compliance and legal agreements, ToU primarily function as a one-time or periodic acceptance mechanism for policies, not as a tool to schedule recurring reviews of *access itself* or to automatically revoke access based on review outcomes. They ensure users acknowledge conditions, but do not govern the lifecycle of access permissions.
- ✓
Access reviews
Why this is correct
Microsoft Entra ID Access Reviews are specifically designed to manage the lifecycle of access to resources, groups, and applications by enabling regular, scheduled reviews. Administrators can configure these reviews to recur periodically, assign reviewers, and set up automatic actions, such as revoking access for users who are not approved or whose review is not completed within a specified timeframe. This functionality directly addresses the requirement for recurring access validation and automated revocation.
- ✗
Privileged Identity Management
Why it's wrong here
Microsoft Entra Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources by providing just-in-time (JIT) and time-bound access for privileged roles. While PIM does include access reviews for *privileged roles*, its primary scope is elevated permissions, not the broader, recurring review of *all* user access to groups or applications, nor does it inherently provide auto-revocation for non-completion of general access reviews. It's about minimizing the attack surface for high-impact roles.
- ✗
Entitlement management
Why it's wrong here
Microsoft Entra Entitlement Management enables organizations to manage identity and access lifecycle at scale by packaging resources into "access packages" that users can request. While access packages can have an expiration date and require approval workflows, Entitlement Management itself is primarily focused on delegating access requests and provisioning, not on conducting recurring, scheduled reviews of *existing* access for all users with auto-revocation based on review outcomes. It streamlines initial access granting and time-bound access, but not the periodic re-validation process.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.