SC-100 Certification Practice Question #86

Question

Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a server that runs Windows Server and hosts shared folders. The domain syncs with Azure AD by using Azure AD Connect. Azure AD Connect has group writeback enabled.

You have a Microsoft 365 subscription that uses Microsoft SharePoint Online.

You have multiple project teams. Each team has an AD DS group that syncs with Azure AD.

Each group has permissions to a unique SharePoint Online site and a Windows Server shared folder for its project. Users routinely move between project teams.

You need to recommend an Azure AD Identity Governance solution that meets the following requirements:

•	Project managers must verify that their project group contains only the current members of their project team.
•	The members of each project team must only have access to the resources of the project to which they are assigned.
•	Users must be removed from a project group automatically if the project manager has NOT verified the group's membership for 30 days.
•	Administrative effort must be minimized.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Three requirements drive box 1: project managers must *verify* membership, members are *auto-removed* if not verified within 30 days, and admin effort must be minimized. MS Learn's access-reviews guidance maps directly: assign managers/owners as reviewers, set "If reviewers don't respond → Remove access" with auto-apply, which removes unreviewed members automatically — this is exactly what access reviews are designed for, whereas PIM (privileged roles) and lifecycle workflows (attribute-based JML automation) don't fit manager attestation. For box 2, the scenario states each team already has an AD DS group that syncs to Azure AD and Azure AD Connect has group writeback enabled, so the least-effort, correct action is to enable writeback for those existing synced groups rather than creating new cloud-only groups. Confidence is capped at 84 (not higher) because of a genuine community split on box 1 between Access reviews and Entitlement management, and a parallel debate on box 2 about whether on-prem-synced groups can have writeback enabled (some argue a cloud group is required); the top-voted answer (47 👍) and MS Learn both favor the selection above.

More SC-100 practice questions