SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?
⚠ Common exam trap
Many candidates confuse conditional access policies (which control sign-in conditions) with automated lifecycle actions, mistakenly thinking a policy can proactively revoke access upon termination without the underlying user state change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.
Microsoft Entra lifecycle workflows automate the user offboarding process by disabling the user account and removing group memberships upon termination. This ensures that the user loses access to all SaaS applications that rely on Entra ID for authentication, as group membership removal revokes access tokens and disables sign-in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a conditional access policy to block access for disabled users.
Why it's wrong here
Configuring a Conditional Access policy to block access for disabled users is a reactive measure, not a proactive offboarding solution. While such a policy would prevent a *disabled* user from accessing resources, it does not perform the crucial steps of actually disabling the user account or removing their group memberships upon termination. The primary goal is to automate the disabling and access removal process itself, which Conditional Access policies are not designed to do.
- ✗
Use Privileged Identity Management to remove role assignments.
Why it's wrong here
Privileged Identity Management (PIM) is designed to manage and govern access to *privileged* roles within Microsoft Entra ID, such as Global Administrator or Application Administrator. While PIM can remove these specific high-level role assignments, it does not manage standard user group memberships or general application access that isn't tied to a privileged role. Therefore, PIM alone cannot ensure all application access and group memberships are removed for a terminated user.
- ✗
Schedule an access review for quarterly review of access.
Why it's wrong here
Scheduling an access review for quarterly review of access is a governance mechanism for periodic re-certification of existing access, not an immediate offboarding action. If a user is terminated, waiting for a quarterly review means they could potentially retain access to organizational resources for up to three months, posing a significant security risk. Access reviews are for validating ongoing need, not for event-driven, immediate access revocation upon termination.
- ✓
Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.
Why this is correct
Microsoft Entra lifecycle workflows are specifically designed to automate user lifecycle events, including offboarding. These workflows can be configured to automatically disable a user account, remove them from specified groups, and revoke application access immediately upon a termination event, often triggered by changes synced from an HR system. This ensures timely, consistent, and comprehensive removal of access, directly addressing the requirement for efficient and secure offboarding.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
User account
A user account is a digital identity that allows a person to access a computer system, network, or application with specific permissions and settings.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.