Which Role Creates Entra Role Access Reviews?

SC-300 By islever Editorial Last updated

Plan, implement, and manage access reviews in Microsoft Entra Plan and implement privileged access

Short answer

D Assign Privileged Role Administrator so User1 can create access reviews for Microsoft Entra role assignments.

Question

You have a Microsoft 365 E5 subscription that contains a user named User1.
You need to ensure that User1 can create access reviews for Microsoft Entra roles. The solution must use the principle of least privilege.
Which role should you assign to User1?
  1. Identity Governance Administrator
  2. User Access Administrator
  3. User Administrator
  4. Privileged Role Administrator Correct Answer

Key Takeaways

The question tests which role holds the permission 'Manage access reviews for Microsoft Entra role assignments'; the trap is assuming Identity Governance Administrator covers all access reviews.

Access reviews for Microsoft Entra directory roles are governed by PIM and require the Privileged Role Administrator role. This page explains why that role is the least-privilege answer over Identity Governance Administrator and the other options.

Common mistake: Option A (Identity Governance Administrator) is the most-voted wrong choice, because that role creates access reviews only for groups, Teams, enterprise apps, and access packages—not for Entra directory roles.

Expert Analysis

Why the Answer Is Correct

Microsoft's permissions reference lists, under Privileged Role Administrator, the ability to "Manage access reviews for Microsoft Entra role assignments." Creating a review of directory role assignments (Global Admin, User Admin, etc.) is performed through Microsoft Entra ID Governance / PIM, which is exactly what this permission governs. Among the four options, only Privileged Role Administrator holds that permission, so it is required regardless of how broad it is. The least-privilege principle then rules out anything broader: Identity Governance Administrator grants governance-wide capability over groups, apps, and entitlement management that User1 would not need. Assigning a single, purpose-matching role that enables the required task is the least-privilege outcome here.

Why the Other Options Are Wrong

Identity Governance Administrator (A) can create and manage access reviews for groups, Teams, enterprise apps, and access packages, but its documented scope does not include reviews of Microsoft Entra role assignments. User Access Administrator (B) is an Azure RBAC-style role for managing user access to Azure resources, not Entra directory roles or ID Governance reviews. User Administrator (C) manages identities and authentication methods and has no access-review creation permission for Entra roles. None of these three can launch a PIM review of Microsoft Entra role assignments, so each fails the stated requirement.

Community Comment Notes

Commenters split sharply: as KindFlame and sheilawu argued, the Identity Governance Administrator permission statement covers reviews for groups and apps, and VidJay pointed to the standard access-review creation page. Against that, captainspork spelled out the split precisely—Privileged Role Administrator covers "Entra Roles (like Global Admin, User Admin, Helpdesk Admin)"—and JFROG cited the permissions reference noting only Privileged Role Administrator shows "manage access reviews for Microsoft Entra role assignments." ppardav and raduM reinforced D by pointing to the PIM roles-review procedure and the admin center listing role-assignable group review permissions under Privileged Role Administrator.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the scope qualifier carefully: 'access reviews for Microsoft Entra roles' is a PIM-scoped capability, distinct from reviews of groups or apps. Map each governance permission to its documented role before choosing, since Identity Governance Administrator and Privileged Role Administrator have deliberately split domains.

Frequently Asked Questions

Why is Identity Governance Administrator wrong if it manages access reviews?

That role's documented scope covers reviews of groups, Teams, enterprise apps, and access packages. Reviews of Microsoft Entra role assignments are managed by Privileged Role Administrator.

Is Privileged Role Administrator still least privilege if it is a highly privileged role?

Yes, because it is the only listed role that includes 'Manage access reviews for Microsoft Entra role assignments.' Least privilege means granting the smallest set that still enables the required task.

More SC-300 FAQ →

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. VidJay 👍 3 Answered A
    https://learn.microsoft.com/en-us/entra/id-governance/create-access-review#create-a-single-stage-access-review Scope mentioned - to create access review, login as Identity Governance Administrator
  2. JinShi 👍 3 Answered D
    User Access Administrator role primarily focuses on managing user access
  3. KindFlame 👍 2 Answered A
    Identity Governance Administrator "[Can] Create and delete access reviews, and read and update all properties of access reviews in Microsoft Entra ID" https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#identity-governance-administrator It is not "Privileged Role Administrator" because this role comes with way more permissions than "Identity Governance Administrator". "Users assigned to this role can grant themselves or others additional privilege by assigning additional roles." https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator
  4. JFROG 👍 2 Answered D
    If you look in https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator The Privileged Role Administrator has hanage access reviews for Microsoft Entra role assignments. I don't see this with the Identity Governance Administrator (more groups etc). My choice is D.
  5. captainspork 👍 2 Answered D
    Guys, Identity governance admin access reviews: -Groups (Teams, M365 Groups, Security Groups) -Enterprise Apps (App access for users) -Access packages (Entitlement management) Privileged role admin access reviews: -Entra Roles (like Global Admin, User Admin, Helpdesk Admin) -Azure Resources (RBAC on subscriptions/resource groups)
Show 9 more comments
  1. sheilawu 👍 2 Answered A
    Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator. Browse to ID Governance > Access Reviews. Select New access review to create a new access review.
  2. Btn26 👍 2
    Changing answer to D.
  3. Btn26 👍 1 Answered A
    The correct answer is A. Identity Governance Administrator Here's why: Identity Governance Administrator: This role provides the necessary permissions to manage identity governance tasks, including creating and managing access reviews for Microsoft Entra roles. User Access Administrator: This role provides permissions to manage user access within the organization, but it may not include the specific permissions to create access reviews for Entra roles. User Administrator: This role is primarily for managing user accounts and basic attributes, not for managing identity governance. Privileged Role Administrator: This role is for managing privileged roles within the organization, which is a broader scope than just creating access reviews
  4. anonymousarpanch 👍 1 Answered D
    To create access reviews for Microsoft Entra roles, you must be assigned at least the Privileged Role Administrator role. For access package it should be Identity governance administrator. For security groups, applications it should be Identity governance administrator. To create access reviews for Azure resources, you must be assigned to the Owner or the User Access Administrator role for the Azure resources.
  5. raduM 👍 1 Answered D
    please take a look in admin center:Delete access reviews for membership in groups that are assignable to Microsoft Entra ID roles Create access reviews for membership in groups that are assignable to Microsoft Entra ID roles Update all properties of access reviews for membership in groups that are assignable to Microsoft Entra ID roles these properties are only fore priviledge role administrator
  6. FS202 👍 1 Answered A
    The question specifically says create access reviews for Microsoft Entra roles. Access reviews for Microsoft Entra roles are part of Microsoft Entra ID Governance / Privileged Identity Management (PIM). The Identity Governance Administrator role has the permissions required to manage and create access reviews while following the principle of least privilege
  7. Pastusz 👍 1 Answered A
    Identity Governance Administrator: Może tworzyć i zarządzać Access Reviews. Może konfigurować Entitlement Management, Lifecycle workflows, itp. Nie ma pełnych uprawnień administracyjnych do użytkowników czy ról – co spełnia zasadę least privilege.
  8. ppardav 👍 1 Answered D
    Correct answer should be D as per following MS link https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review
  9. krzkrzkra 👍 1 Answered D
    D. Privileged Role Administrator

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How Long Are Microsoft Entra Risky User Activity Logs Retained?

S-grade

Azure User-Assigned Managed Identity Regional Scope

S-grade

Which role for the Permissions Management service principal?

S-grade

Prerequisite for Microsoft Defender for Cloud Apps Session Policy

S-grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide