SC-900 Describe the capabilities of Microsoft Entra Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Conditional Access policy

  Why it's wrong here

  Conditional Access policies are designed to enforce access controls in real-time based on specific conditions like user location, device compliance, or sign-in risk. While they can block or grant access, or require multi-factor authentication, they do not possess functionality to modify group memberships or automatically remove users from groups due to inactivity. Their role is to govern *how* access is granted, not *who* is a member of a group.

• ✗

  Privileged Identity Management

  Why it's wrong here

  Privileged Identity Management (PIM) is a service focused on managing, controlling, and monitoring access to important resources by providing just-in-time (JIT) and just-enough-access (JEA). PIM primarily applies to Microsoft Entra roles, Azure resource roles, and groups assigned to roles, allowing for temporary elevation of privileges. It does not provide a mechanism to automatically remove inactive users from standard security or Microsoft 365 groups that are not assigned to a privileged role.

• ✓

  Access reviews in Identity Governance

  Why this is correct

  Access reviews, a core component of Microsoft Entra Identity Governance, enable organizations to efficiently manage group memberships, application access, and role assignments. They allow administrators or group owners to periodically review who has access to what, and crucially, can be configured to automatically remove users from groups if they fail to attest to their continued need for access or if they are identified as inactive based on sign-in data. This capability directly addresses the requirement to maintain clean group memberships by removing inactive users.

• ✗

  Microsoft Entra ID Protection

  Why it's wrong here

  Microsoft Entra ID Protection is a security feature focused on detecting, investigating, and remediating identity-based risks within an organization. It identifies suspicious activities such as impossible travel, leaked credentials, or sign-ins from unfamiliar locations, and can enforce automated responses like requiring multi-factor authentication or blocking access. However, ID Protection's primary function is risk detection and response, not the lifecycle management of group memberships or the automatic removal of inactive users from groups.

Go deeper

Related to this question