Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A compliance officer requires a periodic review process for all users (including guests) who have access to highly sensitive data in specific Microsoft 365 groups and applications. The goal is to ensure that access is still appropriate and to automatically remove access for those who no longer need it. Which Microsoft Entra capability is designed for this purpose?
- AMicrosoft Entra Privileged Identity Management (PIM)
- BMicrosoft Entra Entitlement Management
- CMicrosoft Entra Access Reviews
- DMicrosoft Entra Conditional Access
Show answer & explanationAnswer & explanation
Correct answer: C. Microsoft Entra Access Reviews
Microsoft Entra Access Reviews allow organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments. They enable reviewers (e.g., business owners) to periodically certify that users still need access, and automatically remove access for those who don't.
Why the other options are wrong
- A. PIM manages just-in-time access for *privileged* roles, not general access reviews for all users/groups.
- B. Entitlement Management focuses on initial access requests and lifecycle, not periodic re-certification of existing access.
- D. Conditional Access enforces real-time access policies, not periodic reviews of existing access.
Microsoft Entra Access Reviews
An identity governance feature that enables organizations to efficiently manage group memberships, access to enterprise applications, and privileged role assignments.
- Automates periodic review and certification of access.
- Reviewers can be group owners or business users.
- Can automatically remove access for unapproved users.
Memory trick: Access Reviews are like a regular audit to make sure everyone still needs their keys.