Task 2.4: Describe identity protection and governance capabilities of Microsoft Entra

• AAccess reviews

  Incorrect

  Access reviews recertify access people already have; they don't create identities.

• BPrivileged Identity Management

  Incorrect

  PIM controls just-in-time activation of privileged roles, not creation of identities.

• CInbound user provisioning

  Correct

  Inbound provisioning maintains user identities in Microsoft Entra ID and Active Directory automatically from the HR system.

• DAccess packages in entitlement management

  Incorrect

  Access packages bundle groups, app roles and sites that users get access to; the identity must already exist.

Identity lifecycle management models join, move and leave, and is often tied to an HR system such as Workday or SuccessFactors. Microsoft Entra ID Governance automates it with inbound provisioning from HR sources, lifecycle workflows, automatic assignment policies in entitlement management and user provisioning to other applications.

• AAn expiration policy for the Microsoft 365 group

  Incorrect

  An expiration policy has owners renew the whole group or let it expire; it doesn't ask them about each guest.

• BA sensitivity label on the group that stops its owner adding guests

  Incorrect

  A label's external user access setting controls whether the owner can add guests; it doesn't remove guests who already have access or ask about each one.

• CA risk-based Conditional Access policy for guest users

  Incorrect

  Risk-based policies respond to sign-ins or accounts that may be compromised, not to whether access is still needed.

• DA recurring access review with the group owner as reviewer

  Correct

  Access reviews recur at set frequencies, and owners confirm guests' need; access can then be removed from those who no longer need it.

Microsoft Entra access reviews let organizations regularly confirm that only the right people keep access. A common use is asking group owners to confirm that guests still have a legitimate business need. Reviews can recur weekly, monthly, quarterly or annually, and results can be applied to remove access.

• AAccess reviews

  Incorrect

  Access reviews periodically recertify who should keep access; they don't make rights exist only on demand.

• BEntitlement management

  Incorrect

  Entitlement management bundles resources into access packages that users request; it isn't built around just-in-time activation of admin roles.

• CConditional Access

  Incorrect

  Conditional Access evaluates signals at sign-in; it doesn't make administrator roles time-bound.

• DPrivileged Identity Management

  Correct

  PIM is just in time, time-bound, approval-based, visible through notifications and auditable with a downloadable history.

Microsoft Entra Privileged Identity Management manages, controls and monitors access to important resources in Microsoft Entra ID, Azure and other Microsoft online services. It provides time-based and approval-based role activation, requires justification, enforces MFA on activation, sends notifications and keeps a full access history that can be downloaded.

• ASuspicious sending patterns from the user's mailbox

  Incorrect

  Suspicious sending patterns are a user risk example: they suggest the account itself is compromised.

• BA sign-in attempt that failed because the password was wrong

  Incorrect

  ID Protection generates risk detections only when correct credentials are used, so a wrong password isn't flagged.

• CA sign-in from an anonymous IP address

  Correct

  An anonymous IP address is a sign-in risk example tied to one authentication request.

• DSuspicious activity reported by the user

  Incorrect

  User reported suspicious activity is a user risk example.

• ESign-ins from two geographically distant locations too close together in time

  Correct

  Atypical travel is a sign-in risk example.

ID Protection links risk detections to a sign-in event (sign-in risk) or to an individual user (user risk, the probability that the identity is compromised). Sign-in risk examples include anonymous IP addresses, atypical travel and unfamiliar sign-in properties. Detections are generated only when correct credentials are used.

• AA group with assigned membership that its owner maintains

  Incorrect

  Assigned membership means members are selected by hand, so changes wouldn't follow the attribute.

• BA quarterly access review of the group

  Incorrect

  An access review recertifies membership periodically; it doesn't add members when their department changes.

• CA group with a dynamic membership rule that Microsoft Entra ID evaluates

  Correct

  Dynamic membership rules add and remove identities automatically as attributes change.

• DAn access package that Sales staff request in My Access

  Incorrect

  A request-based access package waits for each user to ask, so membership wouldn't follow the attribute by itself.

Groups in Microsoft Entra ID can have assigned membership, where members are selected manually, or dynamic membership, where rules on attributes add and remove identities automatically. When a user's attributes change, the system evaluates the dynamic group rules to decide whether the user is added or removed.

• AWhich identities should have access to which resources?

  Correct

  ID Governance addresses who should access what, what they do with it, the controls in place and whether auditors can verify them.

• BWhich emails contain phishing links?

  Incorrect

  Phishing protection is a Defender for Office 365 concern.

• CWhich devices are missing security updates?

  Incorrect

  Device vulnerabilities are a Defender Vulnerability Management concern.

• DWhich cloud apps are employees signing up for without IT's approval?

  Incorrect

  Unapproved cloud apps aren't one of identity governance's four questions.

Microsoft Entra ID Governance helps organizations answer four questions for access across services and applications: Which identities should have access to which resources? What are those identities doing with that access? Are there organizational controls for managing access? Can auditors verify that the controls are working?

• AOnly privileged roles managed in PIM

  Incorrect

  Role assignments can be reviewed, but so can group memberships and application access.

• BOnly guest accounts in Microsoft 365 groups

  Incorrect

  Access reviews aren't limited to guest accounts.

• CGroup memberships, access to enterprise applications and role assignments

  Correct

  Access reviews manage group memberships, enterprise app access and role assignments.

• DOnly passwords that are about to expire

  Incorrect

  Access reviews recertify access, not passwords.

Microsoft Entra access reviews let organizations efficiently manage group memberships, access to enterprise applications and role assignments, so that only the right people keep access.

• AOnly the sign-in logs of the customer's own tenant

  Incorrect

  ID Protection draws on far broader signals than one tenant's logs.

• BTrillions of daily signals from Microsoft Entra ID, Microsoft Accounts and Xbox

  Correct

  This broad range of signals lets ID Protection detect anonymous IPs, password spray, leaked credentials and more.

• CThird-party threat intelligence feeds that the customer must buy and connect first

  Incorrect

  No connection is needed; the detections come from Microsoft's own signals.

• DEndpoint sensors that Defender for Endpoint installs

  Incorrect

  Defender for Endpoint signals come from devices; ID Protection analyzes identity signals.

Microsoft Entra ID Protection's detections come from the analysis of trillions of signals each day from Microsoft Entra ID, Microsoft Accounts and Xbox. That breadth helps it detect risky behaviors such as anonymous IP address use, password spray attacks and leaked credentials.

• ASign-in logs, audit logs and provisioning logs

  Incorrect

  These are Microsoft Entra monitoring logs, not ID Protection's risk reports.

• BSecure score, compliance score and regulatory compliance

  Incorrect

  These are posture and compliance measures from other products.

• CRisky devices, risky apps and risky mailboxes

  Incorrect

  ID Protection reports cover identities and sign-ins, not devices, apps or mailboxes.

• DRisk detections, risky sign-ins and risky users

  Correct

  Each risk is a risk detection, a sign-in with detections is a risky sign-in, and an affected user is a risky user.

ID Protection tracks detected risks with three reports: risk detections (each risk detected), risky sign-ins (sign-ins with one or more risk detections) and risky users (users with risky sign-ins or risk detections). Investigating them helps find weak points in the security strategy.