Identify the decision and trigger
Identity governance concerns how access is created, maintained, reviewed and removed as circumstances change. A request can ask whether a partner still needs membership, whether an engineer should activate a role for a maintenance window, or whether an identity is at risk. All involve identities, but their triggers and evidence differ. Write the decision and time horizon before choosing a feature. A quarterly business-need decision is not the same event as activating an eligible role today.
Reviews and temporary privilege
Access reviews support recurring decisions about continued group, application or role access. Owners or reviewers assess whether existing access remains needed. Privileged Identity Management supports time- and approval-based activation and just-in-time privileged access. PIM can also support reviews, so the distinction is not that PIM never reviews anything. The useful distinction is the requested operation: recertifying continued need versus controlling when an eligible privilege becomes active and for how long.
Lifecycle and risk evidence
Identity Governance includes lifecycle workflows for employment events such as joining, changing status and leaving, alongside access lifecycle capabilities. ID Protection addresses identity-based risks through detection, investigation and remediation; its evidence can inform Conditional Access. A risky sign-in is not a review of whether an employee’s new job still requires an old group membership. Equally, a membership review is not proof that a sign-in is safe. Use each form of evidence for the decision it supports.
Worked example
Fictional teaching case: a cultural foundation has rotating project guests and a small support team. Guests’ project memberships need owner review every quarter. Support engineers need approved role activation during specified maintenance work. Assign the first job to recurring access review and the second to PIM activation. Check the strongest alternative: a periodic review of engineer eligibility can complement PIM, but it does not itself implement each activation window. A time-bound activation likewise does not decide whether a guest’s collaboration membership should continue next quarter.
Transfer check
Try a different trigger: a fictional employee changes department, and the organization wants identity/access lifecycle tasks driven by that status event. A separate security analyst reports evidence of a potentially compromised sign-in. Should one feature be chosen simply because both involve the same employee? Check basis: no. Lifecycle workflows address the employment-event task, while ID Protection addresses identity-risk investigation. Risk evidence may influence access policy, but it does not replace the business event or determine the employee’s intent.
Check scope and uncertainty
Explain which feature answers which question and what it does not establish. Governance tools can work together and require appropriate entitlement/configuration; this lesson does not promise a license or configure a tenant. Neither risk scores nor review outcomes establish legal compliance or guilt. Preserve any missing approval, business-need evidence or risk context as unknown.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
What are access reviews? - Microsoft Entra - Microsoft Entra ID Governance | Microsoft LearnMicrosoft Entra Conditional Access: Zero Trust Policy Engine - Microsoft Entra ID | Microsoft LearnMicrosoft Entra ID Governance - Microsoft Entra ID Governance | Microsoft LearnWhat is Microsoft Entra ID Protection? - Microsoft Entra ID Protection | Microsoft LearnWhat is Privileged Identity Management? - Microsoft Entra ID Governance | Microsoft Learn