SC-100 Certification Practice Question #34

Question

You have 10 Azure subscriptions that contain 100 role-based access control (RBAC) role assignments.

You plan to consolidate the role assignments.

You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort.

What should you include in the recommendation?

Accepted Answer

The requirement — identify RBAC role assignments NOT used in the last 90 days across 10 subscriptions with minimal effort — is the canonical Microsoft Entra Permissions Management (Cloud Infrastructure Entitlement Management) use case. MS Learn explicitly lists "Inactive identities: identities that haven't used any of their granted permissions in the last 90 days" as a native Permissions Management finding, automatically discovered with no per-assignment manual review. Access reviews (B) cover membership attestation and demand recurring reviewer effort, so they fail the "minimize administrative effort" constraint; PIM (C) targets just-in-time activation rather than usage analytics; Defender for Cloud (A) does not enumerate stale RBAC assignments. Both the official Suggested Answer and the 12-vote community consensus land on D. Confidence is held at 84% rather than higher because Permissions Management was retired in late 2025, which split the community (B/A/C dissent) and makes this a dated item, but the exam-intended answer remains D.

More SC-100 practice questions