Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Access reviews are part of Microsoft Entra ID Governance. They let administrators or resource owners schedule recurring or one-time reviews of group memberships, application access, or privileged role assignments. Reviewers receive notifications and can approve or deny each user. At the end of the review, any user who is denied or not reviewed can be removed automatically. Conditional Access policies evaluate sign-in conditions but do not ask owners to re-certify membership. Privileged Identity Management focuses on just-in-time activation of privileged roles, not ongoing membership attestation for regular groups. Microsoft Entra ID Protection detects and responds to risky sign-ins or users but does not provide scheduled access certifications. Therefore, access reviews are the appropriate capability for the scenario described.