Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A global enterprise uses Microsoft Entra ID and has a complex organizational structure with many departments and projects. They need a scalable solution to delegate the management of access to specific internal applications and resources to department leads, empowering them to approve or deny access requests without involving central IT. Which Microsoft Entra capability supports this delegated access management?
- AMicrosoft Entra Conditional Access
- BMicrosoft Entra Access Reviews
- CMicrosoft Entra Entitlement Management
- DMicrosoft Entra Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Entitlement Management
Microsoft Entra Entitlement Management allows organizations to manage identity and access lifecycle at scale by enabling delegated administration to non-IT users (like department leads) for approving access to groups, applications, and SharePoint sites. This directly addresses the need for delegated access management and approval workflows.
Why the other options are wrong
- A. Conditional Access enforces policies based on conditions but does not provide delegated approval workflows for resource access.
- B. Access Reviews focus on periodic verification of existing access, not the initial granting or delegated approval process.
- D. PIM manages just-in-time access for privileged roles, not delegated access approval for general users to applications.
Microsoft Entra Entitlement Management
A governance capability that enables organizations to manage identity and access lifecycle at scale, by automating access requests, approvals, provisioning, and de-provisioning.
- Delegates access management to business owners.
- Manages access to groups, applications, and SharePoint sites.
- Automates access lifecycle (request, approval, review, expiration).
Memory trick: Entitlement Management lets business owners be the gatekeepers.