Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraHard
A healthcare organization uses Microsoft Entra ID and is subject to strict regulatory compliance. They need to demonstrate that access to sensitive patient data applications is regularly reviewed and that users who no longer require access have their permissions revoked. The reviews should be recurring and generate audit trails. Which Microsoft Entra governance capability is best suited for this task?
- AMicrosoft Entra Access Reviews
- BMicrosoft Entra Privileged Identity Management (PIM)
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Identity Protection
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Entra Access Reviews
Microsoft Entra Access Reviews allow organizations to manage access to groups, applications, and roles by enabling regular reviews of who has access. This helps meet compliance requirements by ensuring that only necessary access is maintained and generating audit trails for accountability.
Why the other options are wrong
- B. PIM manages just-in-time access for *privileged* roles, not general user access reviews for compliance.
- C. Conditional Access enforces policies at sign-in, it does not provide a mechanism for periodic review and re-certification of existing access.
- D. Identity Protection detects risks and automates responses, but doesn't provide a recurring review process for access permissions.
Microsoft Entra Access Reviews
A Microsoft Entra ID governance capability that enables organizations to efficiently manage group memberships, access to enterprise applications, and role assignments.
- Automates recurring reviews of user access
- Delegates review decisions to resource owners
- Generates audit logs for compliance reporting
- Can automatically revoke access based on review outcomes
Memory trick: Access Reviews are like a periodic compliance check-up.