Temporary Access with Entra Entitlement Management

Plan and implement entitlement management in Microsoft Entra
Answer Correct answer: A — Use an access package to provide time-bound access to resources for members of Group1.

You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1 and a Microsoft 365 group named Group1. You need to ensure that the members of Group1 can access Site1 for 90 days. The solution must minimize administrative effort. What should you use?

  1. an access package Correct Answer
  2. an access review
  3. a lifecycle workflow
  4. a Conditional Access policy
entra entitlement management access package expiration temporary sharepoint access sc-300 exam questions

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The core trap is confusing identity governance tools (access packages) with security policies (Conditional Access). Only entitlement management natively supports expiration-based access bundles with minimal admin effort.

This question tests the ability to configure temporary resource access in Microsoft Entra ID. The correct solution utilizes an access package to grant time-bound permissions while minimizing administrative overhead.

Learners often choose Conditional Access because it controls access, but they fail to realize it cannot automatically expire a user's membership or access rights after a set number of days without complex custom attributes and automation.

Community Discussion (3 comments)

ANiMOSiTYOP 👍 7
A. an access package For this scenario, an access package would be the most suitable. An access package in Azure Active Directory (Azure AD) entitlement management is a bundle of resources that you can give to users so they can access a set of related resources. They can be configured to expire after a certain amount of days (in this case 90 days), after which access to the resources is automatically revoked, saving administrative effort.
AirSB 👍 1 Selected: A
To provide temporary access to Site1 for members of Group1 with minimal administrative effort, you can use an access package in Microsoft Entra Identity Governance. Access packages allow you to grant users access to resources (e.g., SharePoint sites, Microsoft 365 groups) for a specific duration, such as 90 days.
Wazery 👍 1
D. eine Richtlinie für bedingten Zugriff Eine Richtlinie für bedingten Zugriff ermöglicht es Ihnen, den Zugriff auf SharePoint Online-Sites basierend auf bestimmten Bedingungen zu steuern, wie z. B. Standort, Gerät oder Netzwerkzugehörigkeit. In diesem Szenario können Sie eine bedingte Zugriffsrichtlinie erstellen, die sicherstellt, dass die Mitglieder der Gruppe Group1 für einen Zeitraum von 90 Tagen auf die SharePoint Online-Site Site1 zugreifen können. Diese Richtlinie würde den Verwaltungsaufwand minimieren, da sie automatisiert ist und die Zugriffssteuerung auf Gruppenebene vereinfacht.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

An access package within Microsoft Entra Entitlement Management is designed specifically for this scenario. It allows administrators to bundle resources (like Site1 and Group1) and assign them to users or groups for a defined duration (90 days). Once the period expires, access is automatically revoked, satisfying the 'minimize administrative effort' requirement.

Why the Other Options Are Wrong

Access reviews (B) are used to evaluate existing access, not to provision temporary access. Lifecycle workflows (C) can manage changes but require defining specific triggers and actions that are more complex than a simple expiration policy. Conditional Access (D) enforces conditions like location or device compliance but does not natively support automatic access expiration based on a timer for group membership.

Community Comment Notes

Community consensus strongly favors Option A. Users note that access packages allow for automatic expiration, which directly addresses the 90-day constraint. One commenter highlighted that access packages are the standard method for granting related resources to users for a set time, effectively automating the lifecycle of the access.

Exam Strategy

When you see 'temporary access', 'expiration', or 'bundle of resources', think immediately of Entitlement Management and Access Packages. Distinguish these from Conditional Access, which handles real-time security checks rather than time-based provisioning.

Frequently Asked Questions

Why not use Conditional Access for expiration?

Conditional Access evaluates requests at sign-in but cannot automatically revoke access or expire memberships after a fixed duration like 90 days.

Do access packages require user approval?

Not necessarily; you can configure them to auto-approve assignments for specific groups, minimizing administrative effort.

Related Analysis

You have an Azure subscription named Sub1 that contains a re

S-Grade

You have a Microsoft 365 subscription. You plan to deploy an

S-Grade

You have a Microsoft 365 E5 subscription that contains the u

A-Grade

Practice All SC-300 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-300 Practice Test →

← Back to SC-300 Study Guide