Using Microsoft Entra Permissions Management to find unused RBAC assignments

SC-100 By islever Editorial Last updated

Design solutions for securing privileged access

Short answer

D Microsoft Entra Permissions Management shows unused permissions and identities across subscriptions, identifying role assignments not used in 90 days.

Question

You have 10 Azure subscriptions that contain 100 role-based access control (RBAC) role assignments. You plan to consolidate the role assignments. You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort. What should you include in the recommendation?
  1. Microsoft Defender for Cloud
  2. Microsoft Entra access reviews
  3. Microsoft Entra Privileged Identity Management (PIM)
  4. Microsoft Entra Permissions Management Correct Answer

Key Takeaways

Permissions Management (CIEM) reports unused permissions over time across many subscriptions; access reviews (B) assess whether a user should keep membership, not whether a role was used, and PIM (C) governs eligibility rather than usage.

To identify which RBAC role assignments across 10 subscriptions were not used in the last 90 days with minimal effort, use Microsoft Entra Permissions Management, whose analytics reveal unused permissions and identities that have not exercised a permission over a period, across multicloud subscriptions.

Common mistake: Choosing Entra access reviews (B) — they review whether users still need group/role membership, not whether a role assignment was actually used in the last 90 days.

Expert Analysis

Why the Answer Is Correct

Microsoft Entra Permissions Management (a CIEM solution) provides usage analytics that show which identities have not used a permission (including RBAC role assignments) over a defined period such as 90 days, across many subscriptions, with minimal administrative effort. This directly answers the requirement to find unused role assignments.

Why the Other Options Are Wrong

Microsoft Entra access reviews (B) ask reviewers whether a user should retain membership/assignment, but they do not measure whether the assignment was actually used. PIM (C) manages eligible/just-in-time assignment, not usage history. Defender for Cloud (A) focuses on security posture, not permission usage.

Community Comment Notes

The community favored D (53 votes). Comments cite the Permissions Management overview and the three-step permissions-management operations guide showing it can report identities that have not used a permission in the last 90 days; a minority (B, 40 votes) confused access reviews with usage detection.

Official Reference

https://learn.microsoft.com/en-us/entra/permissions-management/overview

This link opens the official vendor documentation in a new tab.

Community Votes

D
57%
B
43%

57% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Sundaycorn 👍 2 Answered B
    Access reviews cover rbac roles which this question is asking. Microsoft Entrance Permissions Management covers users, groups, sites etc.
  2. zpack 👍 2 Answered D
    Wrong answer, correct is D. Access review is to see if users should still belong to groups, not to see if a role wasn't used in 90 days.
  3. 676ae1a 👍 1 Answered B
    B.Reseñas de acceso a Microsoft Entra: Esta herramienta permite auditar y revisar el uso de roles y permisos en Azure, facilitando la identificación de asignaciones de roles que no se han utilizado. Puedes generar informes detallados y filtrar las asignaciones de roles según el período de tiempo especificado
  4. Er_01 👍 1 Answered C
    The best answer is C as it can create a review every quarter to verify membership or self review access, which would give you a list. The question is incomplete as it leaves out the taking action part to remove stale access.
  5. 424ede1 👍 1 Answered D
    Microsoft Entra Permissions Management The answer is obvious in following Microsoft diagrams https://learn.microsoft.com/en-us/entra/architecture/permissions-manage-ops-guide-three
Show 8 more comments
  1. lam_15 👍 1 Answered D
    Microsoft Entra Permissions Management: https://learn.microsoft.com/en-us/entra/permissions-management/overview
  2. RabbitB 👍 1 Answered D
    Entra Permissions Management. This explains everything. https://www.youtube.com/watch?v=-S-z3qx79YQ
  3. AleFerrillo 👍 1 Answered D
    EPM can tell you if an identity has not used a permission in the last 90 days
  4. reyreyg 👍 1 Answered B
    https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview
  5. oscarpopi 👍 1 Answered D
    Right answer is EPM -> 100 subscriptions and minimal effort.
  6. AlbertE1nstein 👍 1 Answered B
    B. Microsoft Entra access reviews
  7. Lrrr_FromOmicronPersei8 👍 1 Answered D
    Entra Permissions Management
  8. Ali96 👍 1 Answered B
    Entra access reviews

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Applying customer-managed key encryption at the file level in Data Lake Storage

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide