SaveMyCert
Log in
5 of 5 free questions left today·for 30 a day
SC-500 · Domain 1

Manage identity, access, and governance practice questions

Manage identity, access, and governance is worth 24% of the SC-500 exam — the 2nd-heaviest of the 4 domains. Microsoft Entra ID access controls (PIM, Conditional Access, authentication methods, app identities, managed identities), Azure Key Vault, and governance with Azure Policy, Defender for Cloud, RBAC and locks. Official weighting 20–25%. 6 fully worked examples are further down this page, answers included.

Exam weight
24%
the 2nd-heaviest of the 4 domains
Questions
114
across 3 topics
Free, no account
5/day
a free account allows 30 a day
Explanations
Every option
right and wrong

Build a practice session

5 free questions left today.

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across 1 of 4 domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

6 sample Manage identity, access, and governance questions, fully explained

Questions from the SC-500 bank mapped to domain 1, with the answer key and the reasoning behind every option. None of them repeat the examples on the main SC-500 practice page.

Question 1Manage identity, access, and governance

A company manages the Global Administrator role with Privileged Identity Management. Two new requirements apply: activation must be completed with a phishing-resistant method even when the user signed in earlier in the session with a password and an Authenticator push, and a second person must confirm every activation. Which two role settings should you configure? (Select TWO.)

Choose TWO.

  • a
    On activation, require Microsoft Entra Conditional Access authentication context Correct

    This links activation to a Conditional Access policy for an authentication context. That policy can require the Phishing-resistant MFA authentication strength, so earlier push MFA does not satisfy it.

  • b
    On activation, require multifactor authentication

    This accepts any MFA method, and Microsoft notes the user might not be prompted if they already completed MFA earlier in the session. The push MFA would satisfy it.

  • c
    Require ticket information on activation

    A ticket number is an information-only field; PIM does not verify it against a ticketing system, so no second person confirms the activation.

  • d
    Require approval to activate Correct

    Approval sends each activation request to the selected approvers, so a second person must confirm it before the role becomes active.

  • e
    Require multifactor authentication on active assignment

    This applies when an administrator creates an active assignment, not when an eligible user activates the role.

The concept

PIM activation requirements: authentication context for method strength, approval for a second person.

Why that’s the answer

Plain 'require MFA on activation' is satisfied by any MFA method and may not prompt at all if the session already contains MFA, so it cannot guarantee a phishing-resistant method. Requiring a Conditional Access authentication context lets a Conditional Access policy demand the Phishing-resistant MFA authentication strength at activation time. Approval is the only setting that puts a second person in the loop; ticket information is never validated.

How to reason it out
  1. Split the requirements: method strength at activation, and a second person.
  2. Recall that the MFA-on-activation setting accepts any MFA already in the token.
  3. Use authentication context plus an authentication strength for the method requirement.
  4. Use Require approval to activate for the second person.

Exam tip: To control how strongly users authenticate at PIM activation, use an authentication context, not the plain MFA checkbox.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

Question 2Manage identity, access, and governance

Developers need the Owner role on a production subscription a few times a month. The security team wants the same just-in-time activation, approval and audit trail it already uses for Microsoft Entra roles, applied to this Azure access. What should you do?

Choose one.

  • a
    Create a custom Microsoft Entra role with Owner-equivalent permissions

    Microsoft Entra roles govern the directory, not Azure resources. Subscription Owner is an Azure RBAC role and cannot be reproduced as an Entra role.

  • b
    Assign Owner through Azure RBAC with a condition on the assignment

    Role assignment conditions narrow what an assignment allows for certain actions. The assignment stays permanently active, with no activation or approval.

  • c
    Enable just-in-time VM access on the subscription in Defender for Cloud

    Just-in-time VM access opens management ports on VMs for a limited time. It does not grant or time-limit Azure roles.

  • d
    Create eligible Owner assignments for the subscription in PIM Correct

    PIM manages Azure resource roles as well as Microsoft Entra roles. Eligible Owner assignments on the subscription give just-in-time activation with approval and auditing.

The concept

PIM for Azure resources gives just-in-time access to Azure RBAC roles.

Why that’s the answer

PIM covers three kinds of access: Microsoft Entra roles, Azure resource roles and group membership or ownership. Subscription Owner is an Azure RBAC role, so the answer is an eligible assignment on the subscription in PIM, with the same activation settings (approval, MFA, maximum duration). Just-in-time VM access sounds similar but only governs network ports to VMs.

How to reason it out
  1. Identify the access type: an Azure RBAC role on a subscription.
  2. Recall that PIM supports Azure resource roles, not only Entra roles.
  3. Reject look-alikes: Entra custom roles (directory only) and JIT VM access (ports only).

Exam tip: Owner on a subscription is managed just in time with PIM for Azure resources.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

Question 3Manage identity, access, and governance

An organization grants access to several Azure subscriptions and one Microsoft Entra role through a single role-assignable security group. Administrators should join the group for a time-limited window after approval so that the group's access is gained and lost together. You must minimize administrative effort when the group's access changes later. What should you configure?

Choose one.

  • a
    Dynamic membership rules on the group based on job title

    Dynamic rules add members automatically from attributes, but membership is standing, with no approval or time limit. Role-assignable groups also cannot use dynamic membership.

  • b
    Eligible assignments of each Azure role to the individual users

    This works for just-in-time access, but every role has to be activated separately and each later change must be repeated per user and role, which breaks the effort requirement.

  • c
    Eligible membership of the group by using PIM for Groups Correct

    PIM for Groups makes group membership itself eligible. Activating membership grants everything the group carries at once, with approval and a time limit, and later access changes are made once on the group.

  • d
    Active time-bound membership of the group added by an owner

    An owner adding members with an end date gives access for the whole period without an approval step at the time of use, so the access is not just in time.

The concept

PIM for Groups: just-in-time membership of a group that carries several role assignments.

Why that’s the answer

Two facts decide this. First, PIM can manage group membership and ownership (PIM for Groups), not only role assignments. Second, activating eligible membership grants every role the group holds in one step, so the group remains the single place to change access later. Eligible per-user role assignments would also give just-in-time access, but they multiply the activations and the administration. Dynamic groups cannot provide approval or time limits, and role-assignable groups do not support dynamic membership.

How to reason it out
  1. Note that the access is bundled in one role-assignable group.
  2. Recall that PIM for Groups makes membership eligible, with approval and expiry.
  3. Compare with per-user eligible role assignments: workable, but more effort.
  4. Choose the option that keeps the group as the single control point.

Exam tip: When a group carries the access, make the group membership eligible with PIM for Groups.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

Question 4Manage identity, access, and governance

Before enforcing a new Conditional Access policy that blocks sign-ins from outside approved countries, the security team wants to see which real sign-ins over the next two weeks the policy would have blocked, without affecting any user. What should you do?

Choose one.

  • a
    Run the What If tool against the policy

    What If evaluates one simulated sign-in that you describe. It does not record what the policy would have done to real traffic over two weeks.

  • b
    Assign the policy to one test user account

    Scoping to a test user enforces the block on that user and tells you nothing about the rest of the organization's sign-ins.

  • c
    Set the policy's state to Report-only mode Correct

    Report-only evaluates the policy on every real sign-in and logs the result in the sign-in logs and workbooks, without enforcing it.

  • d
    Set the policy to apply to a pilot group

    A pilot group enforces the policy on its members, which affects those users, and still leaves other users' sign-ins unmeasured.

The concept

Report-only mode measures a Conditional Access policy's impact on real sign-ins without enforcing it.

Why that’s the answer

Report-only mode is designed for this: the policy is evaluated against every sign-in and the result (would have been blocked, granted, or not applied) is written to the sign-in logs, but nothing is enforced. The What If tool is the tempting near-twin, but it only simulates one sign-in that you specify. Piloting on users enforces the policy on them.

How to reason it out
  1. Note the two requirements: real sign-ins over time, and no user impact.
  2. Recall that report-only logs results without enforcing.
  3. Rule out What If (single simulation) and pilots (enforced).

Exam tip: Report-only shows a policy's real-world impact; What If simulates a single sign-in.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

Question 5Manage identity, access, and governance

You are creating a Conditional Access policy that requires a compliant device for all users and all resources. A misconfiguration, or an outage of the device compliance service, could block every administrator from the tenant. Which two actions follow Microsoft's guidance for avoiding a tenant lockout? (Select TWO.)

Choose TWO.

  • a
    Exclude the Global Administrator role from the policy

    Excluding the most privileged role leaves the accounts attackers target most without the control. Microsoft's guidance is to exclude dedicated emergency accounts instead.

  • b
    Exclude the trusted named location of the head office from the policy

    A location exclusion only helps people sitting in that office and weakens the policy for every user there; it is not a lockout safeguard.

  • c
    Add MFA as an alternative grant with Require one of the selected controls

    This turns the policy into 'compliant device OR MFA', which no longer enforces the compliant-device requirement at all.

  • d
    Exclude two cloud-only emergency access accounts from the policy Correct

    Microsoft recommends at least two cloud-only emergency access accounts excluded from Conditional Access policies, so the tenant can still be administered if a policy misfires.

  • e
    Run the policy in report-only mode before you turn it on Correct

    Report-only shows which sign-ins would be blocked before enforcement, so a mistake is found before it locks anyone out.

The concept

Avoiding Conditional Access lockout: emergency access accounts and report-only testing.

Why that’s the answer

Microsoft's deployment guidance has two safeguards against lockout: keep at least two cloud-only emergency access (break-glass) accounts excluded from Conditional Access policies, and evaluate new policies in report-only mode before enforcing them. Excluding the Global Administrator role or a location weakens protection for real users, and an OR grant quietly drops the requirement.

How to reason it out
  1. Identify the risk: a policy that could block every administrator.
  2. Recall the break-glass guidance: dedicated, cloud-only, excluded accounts.
  3. Add the testing safeguard: report-only before enforcement.
  4. Reject exclusions or grant changes that weaken the policy for real users.

Exam tip: Exclude emergency access accounts and test in report-only before turning on a broad policy.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

Question 6Manage identity, access, and governance

Sign-in logs show password-spray attempts against user accounts that use legacy authentication protocols, which cannot perform MFA. You need to stop these sign-ins while modern Outlook and browser clients keep working. Which Conditional Access configuration should you use?

Choose one.

  • a
    Client apps condition set to browser and mobile apps and desktop clients, with Block access

    These are the modern authentication client types. Blocking them would stop Outlook and browsers and leave the legacy protocols open.

  • b
    Device platforms condition set to unknown platforms, with Block access

    Device platform is detected from the user agent and does not separate legacy protocols from modern ones, so legacy clients are not reliably caught.

  • c
    Sign-in risk condition set to medium and above, with Block access

    Risk-based blocking catches some suspicious sign-ins, but legacy protocol sign-ins that are not flagged would still succeed.

  • d
    Client apps condition set to Exchange ActiveSync and other clients, with Block access Correct

    Exchange ActiveSync clients and Other clients are the legacy authentication client types (protocols that use basic authentication, such as older POP, IMAP and SMTP AUTH clients). Blocking them stops these sign-ins and leaves modern clients alone.

The concept

Blocking legacy authentication with the client apps condition.

Why that’s the answer

Legacy authentication protocols cannot perform MFA, which is why they are used for password spray. In Conditional Access the client apps condition groups them as 'Exchange ActiveSync clients' and 'Other clients'; a policy that targets those with Block access stops them while 'Browser' and 'Mobile apps and desktop clients' (modern authentication) are unaffected. The tempting distractor selects the modern client types, which is the reverse.

How to reason it out
  1. Recognise the symptom: protocols that cannot show an MFA prompt are legacy authentication.
  2. Recall which client app types represent legacy authentication.
  3. Block those types and leave the modern types out of the policy.

Exam tip: Legacy authentication = Exchange ActiveSync and other clients; block them with Conditional Access.

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed Identities — the lesson that teaches this.

What SC-500 domain 1 tests, topic by topic

The official exam guide breaks Manage identity, access, and governance into 3 topics. The question bank follows the same split, so a weak topic shows up as a cluster of misses you can go back and read.

Published SC-500 practice questions per topic in Manage identity, access, and governance
TopicWhat it coversQuestions
Secure access to resources by using Microsoft Entra IDSkills outline section (SC-500 study guide, fetched 2026-10-15). Implement and configure Privileged Identity Management (PIM); Implement conditional access policies; Implement and configure authentication methods, including multifactor authentication (MFA) and passwordless; Implement and configure identity for applications, including enterprise applications and app registrations; Manage OAuth permission grants and consent settings; Implement and configure managed identities for Azure resources.38
Secure secrets and keys by using Azure Key VaultSkills outline section (SC-500 study guide, fetched 2026-10-15). Deploy Key Vault; Configure Key Vault settings; Configure access to Key Vault; Configure firewall settings on Key Vault; Manage keys, secrets, and certificates; Scan for secrets by using Defender Cloud Security Posture Management (Defender CSPM); Implement Defender for Key Vault.38
Implement governance to enforce security and regulatory complianceSkills outline section (SC-500 study guide, fetched 2026-10-15). Implement and configure security controls by using Azure Policy, including built-in and custom policy definitions; Evaluate regulatory compliance by using Microsoft Defender for Cloud; Implement and configure security controls in Defender for Cloud, including security standards and recommendations; Implement resource locks; Manage Azure built-in role assignments; Manage custom roles, including Azure roles and Microsoft Entra roles; Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC); Configure security controls for backup protection by using Azure Backup security features; Implement and configure security controls by using infrastructure as code.38
Total114

Revise Manage identity, access, and governance before you drill it

SC-500 Microsoft Entra ID Access: PIM, Conditional Access, MFA, App Identity and Managed IdentitiesExpect short scenarios about a company and a requirement, followed by which setting, control or identity type to configure. Questions turn on near-twin choices: eligible vs active and permanent vs time-bound assignments in PIM, activation duration vs assignment expiry, MFA-on-activation vs authentication context, report-only vs What If, built-in vs custom authentication strengths, sign-in frequency vs persistent browser session, the methods policy vs Conditional Access, Windows Hello for Business vs passkeys vs certificate-based authentication, app registration vs enterprise application, Assignment required vs Visible to users vs Enabled for users to sign in, the consent policies and classifications, and system-assigned vs user-assigned managed identities. Phrases such as 'least privilege', 'minimize administrative effort', 'no standing privilege' and 'without storing a credential' usually decide between two workable options, and some items ask you to select two actions that together meet the requirement.Secure Secrets and Keys with Azure Key Vault (SC-500)SC-500 tests Key Vault through short scenarios with a stated constraint — least privilege, least administrative effort, no exposure to the internet, a key that must never leave the vault — and options that are all real Key Vault features. Expect to separate near-twins: Secrets User from Reader and Secrets Officer, Key Vault Contributor from data roles, Data Access Administrator from User Access Administrator, Premium from Managed HSM and Cloud HSM, service endpoints from private endpoints, a linked privatelink zone from on-premises DNS forwarding, and the trusted-services bypass from permissions. Several items ask what happens after a change (switching permission models, recovering a deleted vault, enabling purge protection), which object type a lifecycle feature applies to (rotation policies for keys, Event Grid for secrets, issuers and lifetime actions for certificates), and which Defender plan covers which scope of secrets scanning versus runtime threat alerts. Multi-response items ask for two parts of one solution.SC-500 Azure Governance: Policy, Defender for Cloud Compliance, Locks, RBAC and Backup SecurityExpect short Microsoft-style scenarios: an environment, a requirement, and a constraint such as least privilege, deployments must keep succeeding, the exception must expire automatically, the protection must not be reversible, Owners must not override it, or AWS accounts must be covered too. The options are usually near-twins that differ by one property: deny versus modify versus denyAction, a Waiver versus a Mitigated exemption versus an exclusion, CanNotDelete versus ReadOnly, Role Based Access Control Administrator versus User Access Administrator, assignment scope, immutable vault locked versus unlocked, Backup MUA Operator versus Backup MUA Admin, and denyDelete versus denyWriteAndDelete. Some items are select-two, and others give a symptom (existing resources stay non-compliant, a script that lists keys fails, untagged resource groups deploy) and ask for the fix.

Other SC-500 domains

Domain 2: Secure storage, databases, and networking28% of the exam · 135 questionsDomain 3: Secure compute24% of the exam · 114 questionsDomain 4: Manage and monitor security posture24% of the exam · 114 questionsAll SC-500 practice questionsMixed sessions across all 4 domains — the way the real exam interleaves them.

Manage identity, access, and governance: your questions

Manage identity, access, and governance is domain 1 of the SC-500 exam guide and carries 24% of the scored content — the 2nd-heaviest of the 4 domains. On a 50-question paper that works out to roughly 12 questions, though Microsoft Azure does not publish an exact per-domain count and individual exam forms vary.

Source

The domain weight and topic list on this page come from the official SC-500 exam guide.