Which Role Creates Entra Role Access Reviews?
Plan, implement, and manage access reviews in Microsoft Entra
Plan and implement privileged access
Answer
Correct answer: D — assign Privileged Role Administrator so User1 can create access reviews for Microsoft Entra role assignments.
You have a Microsoft 365 E5 subscription that contains a user named User1. You need to ensure that User1 can create access reviews for Microsoft Entra roles. The solution must use the principle of least privilege. Which role should you assign to User1?
Community Insight
The question tests which role holds the permission 'Manage access reviews for Microsoft Entra role assignments'; the trap is assuming Identity Governance Administrator covers all access reviews.
Access reviews for Microsoft Entra directory roles are governed by PIM and require the Privileged Role Administrator role. This page explains why that role is the least-privilege answer over Identity Governance Administrator and the other options.
Option A (Identity Governance Administrator) is the most-voted wrong choice, because that role creates access reviews only for groups, Teams, enterprise apps, and access packages—not for Entra directory roles.
Community Discussion (14 comments)
ppardav
👍 1
Selected: D
Correct answer should be D as per following MS link https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review
FS202
👍 1
Selected: A
The question specifically says create access reviews for Microsoft Entra roles. Access reviews for Microsoft Entra roles are part of Microsoft Entra ID Governance / Privileged Identity Management (PIM). The Identity Governance Administrator role has the permissions required to manage and create access reviews while following the principle of least privilege
captainspork
👍 2
Selected: D
Guys, Identity governance admin access reviews: -Groups (Teams, M365 Groups, Security Groups) -Enterprise Apps (App access for users) -Access packages (Entitlement management) Privileged role admin access reviews: -Entra Roles (like Global Admin, User Admin, Helpdesk Admin) -Azure Resources (RBAC on subscriptions/resource groups)
KindFlame
👍 2
Selected: A
Identity Governance Administrator "[Can] Create and delete access reviews, and read and update all properties of access reviews in Microsoft Entra ID" https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#identity-governance-administrator It is not "Privileged Role Administrator" because this role comes with way more permissions than "Identity Governance Administrator". "Users assigned to this role can grant themselves or others additional privilege by assigning additional roles." https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator
raduM
👍 1
Selected: D
please take a look in admin center:Delete access reviews for membership in groups that are assignable to Microsoft Entra ID roles Create access reviews for membership in groups that are assignable to Microsoft Entra ID roles Update all properties of access reviews for membership in groups that are assignable to Microsoft Entra ID roles these properties are only fore priviledge role administrator
sheilawu
👍 2
Selected: A
Sign in to the Microsoft Entra admin center as at least an Identity Governance Administrator. Browse to ID Governance > Access Reviews. Select New access review to create a new access review.
VidJay
👍 3
Selected: A
https://learn.microsoft.com/en-us/entra/id-governance/create-access-review#create-a-single-stage-access-review Scope mentioned - to create access review, login as Identity Governance Administrator
Pastusz
👍 1
Selected: A
Identity Governance Administrator: Może tworzyć i zarządzać Access Reviews. Może konfigurować Entitlement Management, Lifecycle workflows, itp. Nie ma pełnych uprawnień administracyjnych do użytkowników czy ról – co spełnia zasadę least privilege.
krzkrzkra
👍 1
Selected: D
D. Privileged Role Administrator
anonymousarpanch
👍 1
Selected: D
To create access reviews for Microsoft Entra roles, you must be assigned at least the Privileged Role Administrator role. For access package it should be Identity governance administrator. For security groups, applications it should be Identity governance administrator. To create access reviews for Azure resources, you must be assigned to the Owner or the User Access Administrator role for the Azure resources.
JFROG
👍 2
Selected: D
If you look in https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator The Privileged Role Administrator has hanage access reviews for Microsoft Entra role assignments. I don't see this with the Identity Governance Administrator (more groups etc). My choice is D.
Btn26
👍 1
Selected: A
The correct answer is A. Identity Governance Administrator Here's why: Identity Governance Administrator: This role provides the necessary permissions to manage identity governance tasks, including creating and managing access reviews for Microsoft Entra roles. User Access Administrator: This role provides permissions to manage user access within the organization, but it may not include the specific permissions to create access reviews for Entra roles. User Administrator: This role is primarily for managing user accounts and basic attributes, not for managing identity governance. Privileged Role Administrator: This role is for managing privileged roles within the organization, which is a broader scope than just creating access reviews
Btn26
👍 2
Changing answer to D.
JinShi
👍 3
Selected: D
User Access Administrator role primarily focuses on managing user access
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft's permissions reference lists, under Privileged Role Administrator, the ability to "Manage access reviews for Microsoft Entra role assignments." Creating a review of directory role assignments (Global Admin, User Admin, etc.) is performed through Microsoft Entra ID Governance / PIM, which is exactly what this permission governs. Among the four options, only Privileged Role Administrator holds that permission, so it is required regardless of how broad it is. The least-privilege principle then rules out anything broader: Identity Governance Administrator grants governance-wide capability over groups, apps, and entitlement management that User1 would not need. Assigning a single, purpose-matching role that enables the required task is the least-privilege outcome here.Why the Other Options Are Wrong
Identity Governance Administrator (A) can create and manage access reviews for groups, Teams, enterprise apps, and access packages, but its documented scope does not include reviews of Microsoft Entra role assignments. User Access Administrator (B) is an Azure RBAC-style role for managing user access to Azure resources, not Entra directory roles or ID Governance reviews. User Administrator (C) manages identities and authentication methods and has no access-review creation permission for Entra roles. None of these three can launch a PIM review of Microsoft Entra role assignments, so each fails the stated requirement.Community Comment Notes
Commenters split sharply: as KindFlame and sheilawu argued, the Identity Governance Administrator permission statement covers reviews for groups and apps, and VidJay pointed to the standard access-review creation page. Against that, captainspork spelled out the split precisely—Privileged Role Administrator covers "Entra Roles (like Global Admin, User Admin, Helpdesk Admin)"—and JFROG cited the permissions reference noting only Privileged Role Administrator shows "manage access reviews for Microsoft Entra role assignments." ppardav and raduM reinforced D by pointing to the PIM roles-review procedure and the admin center listing role-assignable group review permissions under Privileged Role Administrator.Official Reference
Exam Strategy
Read the scope qualifier carefully: 'access reviews for Microsoft Entra roles' is a PIM-scoped capability, distinct from reviews of groups or apps. Map each governance permission to its documented role before choosing, since Identity Governance Administrator and Privileged Role Administrator have deliberately split domains.
Frequently Asked Questions
Why is Identity Governance Administrator wrong if it manages access reviews?
That role's documented scope covers reviews of groups, Teams, enterprise apps, and access packages. Reviews of Microsoft Entra role assignments are managed by Privileged Role Administrator.
Is Privileged Role Administrator still least privilege if it is a highly privileged role?
Yes, because it is the only listed role that includes 'Manage access reviews for Microsoft Entra role assignments.' Least privilege means granting the smallest set that still enables the required task.
Related Analysis
Practice All SC-300 Questions
Access 80 questions with complete answers and detailed explanations.
View Full SC-300 Practice Test →