AZ-104 Practice Question 61: Access Reviews Guest Users
Microsoft Azure Administrator Associate (AZ-104) · Test 7 · question 1 of 10
External partners are invited as guests to a project group, and they keep their access long after the project ends. The company wants the group owners to confirm every quarter which guests still need access, and wants guests who are not confirmed to be removed from the group automatically.
Which feature should the administrator configure?
Show answer and explanation
Answer:
Access reviews let the people who know the answer, here the group owners, periodically attest to whether each member still needs access. A review can recur quarterly, and when it is configured to apply results automatically, users who are denied are removed from the group when the review ends. Setting the action for reviewers who do not respond to Remove access covers guests that no one confirmed (the default leaves them unchanged). This is the purpose-built way to remove stale guest access. The feature requires a Microsoft Entra ID Governance or P2 license.
Option A forces re-authentication but never removes anyone. A guest who signs in again keeps the group membership, so stale access remains.
Option C makes things worse. A dynamic rule for the Guest user type would add every guest to the group automatically, instead of limiting the group to guests who still need it.
Option D controls what guests can see and do in the directory, such as reading other users' details. It does not review or remove memberships in a group.
Reference: Create an access review of groups and applications in Microsoft Entra ID