Task 4.2: Plan, implement, and manage access reviews in Microsoft Entra

• AOne review of all users with auto-apply on and If reviewers don't respond set to Remove access

  Incorrect

  With members in scope, the denied guest action can't be configured, so guests would only lose the app.

• BA review of All Microsoft 365 groups with guest users, set to remove denied guests from the tenant

  Incorrect

  The denied guest action isn't configurable for that review type.

• CA review scoped to guest users only, with Block user from signing in for 30 days, then remove user from the tenant, plus a separate review for employees

  Correct

  The block-then-remove action is available only when a review covers guests alone.

• DOne review of all users with auto-apply, then a lifecycle workflow that deletes disabled accounts

  Incorrect

  Auto-apply only removes app access, so there would be nothing disabled for the workflow to act on.

Action to apply on denied guest users is available only when a review is scoped to guest users. Block user from signing in for 30 days, then remove user from the tenant disables denied guests and deletes them after 30 days; with If reviewers don't respond set to Remove access, guests nobody reviewed are denied too. Reviews that include members, or that cover all Microsoft 365 groups with guests, just remove membership.

• AManagers of users, with the finance security team as fallback reviewers

  Correct

  Fallback reviewers review users who have no manager in the directory.

• BGroup owners, with the finance security team added as group owners

  Incorrect

  Owners would review everyone, not each user's manager.

• CUsers review their own access, with the finance security team as fallback

  Incorrect

  Self-review doesn't put managers in charge, and fallback reviewers apply to manager or owner reviews.

• DSelected users, listing every manager and the finance security team

  Incorrect

  Selected reviewers see all users, not only their own reports.

When Managers of users or Group owners are the reviewers, you can add fallback reviewers. A fallback reviewer reviews users without a manager in the directory, or a group without an owner.

• ACreate a new review with auto-apply on and ask the reviewers to repeat their decisions

  Incorrect

  The decisions already exist; a new review only repeats the work.

• BOpen the completed review and select Apply

  Correct

  Applying a completed review's results removes the denied users when auto-apply was off.

• CSelect Reset on the review's results page and wait for it to apply them

  Incorrect

  Reset clears the reviewers' decisions instead of applying them.

• DTurn on auto-apply in the review's settings so the ended review applies itself

  Incorrect

  Settings changes don't reapply an ended review's results; they're applied from the review.

If Auto apply results to resource isn't enabled, an administrator applies the outcome after the review ends by opening the review and selecting Apply. Denied users are then removed from the group or app.

• AA recommendation to approve, since the user still has the license

  Incorrect

  Recommendations are based on sign-in activity, not licenses.

• BA recommendation to deny the user's access

  Correct

  Users without sign-ins in the past 30 days are recommended for denial.

• CNo recommendation until 90 days pass

  Incorrect

  The threshold is 30 days.

• DAn automatic removal before the review starts

  Incorrect

  Recommendations guide reviewers; they don't remove access by themselves.

With No sign-in within 30 days, users who signed in during the previous 30 days are recommended for approval and those who didn't are recommended for denial, whether the sign-ins were interactive or not. The last sign-in date is shown with the recommendation.

• AUp to five

  Incorrect

  The maximum is lower.

• BExactly two

  Incorrect

  Three stages are also possible.

• CUp to ten

  Incorrect

  The maximum is lower.

• DTwo or three

  Correct

  A multi-stage review defines two or three sets of reviewers that review one after another.

A multi-stage review lets the administrator define two or three sets of reviewers who decide one after another. The next stage starts only after a decision is recorded in the previous one, which can reduce the load on later reviewers or provide escalation.

• AAn export of the sign-in logs for the reviewers

  Incorrect

  Sign-in logs show sign-ins, not review decisions.

• BA PIM resource audit export

  Incorrect

  PIM's audit covers role activity, not group and app review decisions.

• CA new access review with the same scope

  Incorrect

  A new review starts new decisions instead of reporting past ones.

• DA review history report in access reviews

  Correct

  Review history reports pull reviewers' decisions for selected reviews and a time frame.

Access reviews can produce a downloadable review history report that pulls the decisions reviewers took, filtered by review type, results and time frame. Roles such as Identity Governance Administrator, Security Reader and Global Reader can create it.

• AReviewers can no longer respond, and the instance can't be restarted

  Correct

  Stopping ends the instance for good.

• BReviewers can keep responding until the original end date

  Incorrect

  Once stopped, reviewers can't respond.

• CThe review pauses and can be resumed later

  Incorrect

  A stopped review can't be restarted.

• DEvery user in scope loses access immediately

  Incorrect

  Stopping ends responses; outcomes depend on the review's settings.

Stopping a review instance ends it: reviewers can no longer respond and it can't be restarted. Stop applies to one instance only; to end a recurring series, change the series end date.