Hotspot Question You have a Microsoft Entra tenant that contains the users shown in the following table. The tenant contains the Microsoft 365 groups shown in the following table. You create an…

This hotspot question tests knowledge of Microsoft Entra Access Reviews, specifically how the scope settings (Teams + Groups, All Microsoft 365 groups with guest users, Guest users only, self-review) determine which users are included in the review and who performs the review.

Submitted by yasin.bd· Mar 6, 2026Plan and implement identity governance

Question

Hotspot Question You have a Microsoft Entra tenant that contains the users shown in the following table. The tenant contains the Microsoft 365 groups shown in the following table. You create an access review named Access1 that has the following settings: - Select what to review: Teams + Groups - Review scope: All Microsoft groups with guest users - Scope: Guest users only - Select reviewers: Users review their own access For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Answer Area

User1 can review their membership in Group1 by using Access 1.
User2 can review their membership in Group3 by using Access1.
User3 can review their membership in Group2 by using Access1.

Explanation

Approach. When an Access Review is configured with 'All Microsoft 365 groups with guest users' as the review scope and 'Guest users only' as the user scope, only guest users (external/B2B users) in Microsoft 365 groups are included in the review - internal members are excluded. The 'Users review their own access' reviewer setting means each guest user reviews their own membership, not an admin or group owner. Therefore: (1) Only guest users who are members of Microsoft 365 groups will be asked to review their own access - internal members like User1 or User2 would NOT be included. (2) Groups that have NO guest users are excluded entirely from Access1. (3) Guest users in qualifying groups receive a self-review request; if they do not respond, their access may be auto-removed depending on the 'if reviewers don't respond' setting. Evaluate each statement by checking: Is the user a guest? Are they in a Microsoft 365 group (not a Security group)? Microsoft 365 groups qualify; Security groups or distribution groups do NOT qualify under 'Teams + Groups' scope targeting M365 groups with guests.

Concept tested. Microsoft Entra Access Reviews configuration - specifically how the combination of 'Teams + Groups', 'All Microsoft 365 groups with guest users', 'Guest users only' scope, and 'Users review their own access' reviewer setting determines which users are reviewed, which groups are in scope, and who performs the review action.

Reference. https://learn.microsoft.com/en-us/entra/id-governance/create-access-review

Topics

#access reviews#guest users#Microsoft 365 groups#self-review scope

Community Discussion

No community discussion yet for this question.

Full SC-300 Practice