I85PREP
⌘ K
MSAP study materials
MSAP study resources

MSAP practice questions

One question at a time. Build your MSAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Manage Azure identities and governance

A company wants to ensure that a user who is assigned the Owner role at the subscription scope can manage all resources in every resource group beneath it. Which statement describes how Azure RBAC role assignments are inherited?

  1. Role assignments must be duplicated at each resource group to take effect.
  2. Role assignments made at a higher scope are inherited by all child scopes. Correct answer.
  3. Role assignments apply only to the exact scope where they are created.
  4. Role assignments at subscription scope apply only to newly created resource groups.

Explanation

Azure RBAC uses a hierarchical scope model in which subscription, resource group, and resource scopes nest inside one another. An assignment at a parent scope is inherited by every child scope, so an Owner assignment at subscription level covers all resource groups and their resources.

Question 2Manage Azure identities and governance

An administrator needs to grant a partner organization's external users read access to a specific resource group without creating guest accounts in the tenant. Which Azure feature should be used?

  1. Entra Connect sync
  2. Conditional Access policy
  3. Azure AD B2C tenant
  4. Entra ID B2B collaboration Correct answer.

Explanation

Microsoft Entra B2B collaboration lets you invite external users as guests so they can be authorized against your tenant's resources without separate credentials. Azure AD B2C is for customer-facing applications, not for granting partner access to your own subscriptions.

Question 3Manage Azure identities and governance

You need to create a custom role that allows a team to restart virtual machines but prevents them from deleting them. Which two properties define what the role permits?

  1. AssignableScopes and Description
  2. Permissions and Conditions
  3. Actions and NotActions Correct answer.
  4. RoleType and IsCustom

Explanation

In a custom role definition, Actions lists the control-plane operations allowed, and NotActions subtracts specific operations from that allowed set. AssignableScopes controls where the role can be assigned, not what operations it permits.

Question 4Manage Azure identities and governance

A subscription must be prevented from exceeding a defined spending limit, and the finance team wants alerts when costs approach the threshold. Which Azure capability directly addresses this requirement?

  1. Azure Advisor cost recommendations
  2. Microsoft Cost Management budgets and alerts Correct answer.
  3. Azure Policy budget enforcement
  4. Resource locks at subscription scope

Explanation

Microsoft Cost Management provides budgets that track spending against a threshold and send alerts when costs approach or exceed it. Budgets are informational and alerting tools; they do not hard-stop resource creation by themselves.

Question 5Manage Azure identities and governance

An organization wants to ensure that any storage account created in a subscription must use HTTPS only. Which Azure governance tool enforces this automatically at creation time?

  1. Azure Policy with a deny effect Correct answer.
  2. Management groups
  3. Azure Blueprints
  4. Resource tags

Explanation

Azure Policy evaluates resources during deployment and can use a deny effect to block creation of noncompliant resources such as storage accounts without HTTPS-only enabled. Blueprints orchestrate artifacts but rely on policy or templates for enforcement.

Question 6Manage Azure identities and governance

A user is assigned the Contributor role at the resource group scope and the Reader role at the subscription scope. What effective permission does the user have on resources in that resource group?

  1. Reader only, because subscription scope takes precedence
  2. No access, because conflicting assignments cancel out
  3. Contributor, because permissions are additive across assignments Correct answer.
  4. Reader, because the least privileged assignment applies

Explanation

Azure RBAC is additive: a principal receives the union of all role assignments that apply at any scope. The Contributor assignment at the resource group scope therefore grants management rights there despite the broader Reader assignment.

Question 7Manage Azure identities and governance

An administrator wants to allow a group of developers to manage virtual machines in one resource group but not assign roles to others. Which built-in role best fits the requirement?

  1. Owner
  2. User Access Administrator
  3. Virtual Machine Contributor Correct answer.
  4. Contributor

Explanation

Virtual Machine Contributor allows management of virtual machines without granting permission to manage access or other resource types. Owner and User Access Administrator both include the ability to assign roles, which exceeds the requirement.

Question 8Manage Azure identities and governance

A company requires that all new resource groups automatically receive a specific tag indicating the department. Which approach enforces this at creation?

  1. A budget alert per resource group
  2. A Conditional Access policy
  3. A resource lock on each resource group
  4. An Azure Policy with an append effect on the tag Correct answer.

Explanation

A policy with the append effect can automatically add the required tag to resources or resource groups during creation. Locks, budgets, and Conditional Access do not add tag metadata.

Question 9Manage Azure identities and governance

You need to organize multiple subscriptions so that policies and role assignments applied at a parent level flow to all of them. Which construct should you create?

  1. A management group hierarchy Correct answer.
  2. A resource group per subscription
  3. An Entra ID administrative unit
  4. A subscription-level budget

Explanation

Management groups provide a container above subscriptions, allowing policies and role assignments to be inherited by all contained subscriptions. Administrative units scope directory administration, not Azure resource governance.

Question 10Manage Azure identities and governance

An administrator needs to allow a service principal to authenticate to Azure without storing a client secret. Which credential type should be configured on the app registration?

  1. A symmetric shared key
  2. A client secret with a 24-month expiry
  3. A federated credential for workload identity Correct answer.
  4. A password credential

Explanation

Federated credentials for workload identity let a service principal obtain tokens from an external identity provider such as GitHub or Kubernetes without storing a secret. Password credentials and client secrets are stored secrets that must be rotated and protected.

Question 11Manage Azure identities and governance

A user reports they cannot sign in because their account is blocked after repeated failed attempts. Which Entra ID setting should the administrator review?

  1. Conditional Access sign-in frequency
  2. Self-service password reset scope
  3. Password protection custom banned list
  4. Smart lockout threshold Correct answer.

Explanation

Smart lockout blocks sign-in after a configurable number of failed attempts and can distinguish valid users from attackers. The banned password list affects password choices, not lockout behavior.

Question 12Manage Azure identities and governance

You want users in a specific group to be required to use multi-factor authentication when accessing the Azure portal from outside the corporate network. Which feature should you configure?

  1. A resource lock on the subscription
  2. A management group
  3. An Azure Policy initiative
  4. An Entra ID Conditional Access policy Correct answer.

Explanation

Conditional Access policies evaluate signals such as group membership and network location to enforce controls like MFA. The other options govern resource configuration or organization, not sign-in requirements.

Question 13Manage Azure identities and governance

An organization must ensure that deleted users can be restored within 30 days. Which Entra ID capability supports this?

  1. Soft delete for users Correct answer.
  2. Entitlement management
  3. Access reviews
  4. Privileged Identity Management

Explanation

Entra ID soft delete retains deleted users for a configurable retention period, allowing restoration during that window. Access reviews, PIM, and entitlement management govern access lifecycle, not restoration of deleted accounts.

Question 14Manage Azure identities and governance

A security team wants administrators to activate the Global Administrator role only when needed, with approval required. Which feature should be enabled?

  1. Azure Policy deny effect
  2. Self-service group management
  3. Entra ID Privileged Identity Management Correct answer.
  4. Entra Connect password hash sync

Explanation

Privileged Identity Management provides just-in-time role activation with approval workflows and time-bound assignments for privileged roles. The other options address synchronization, resource compliance, or group self-service.

Question 15Manage Azure identities and governance

You need to delegate the ability to reset passwords for users in the Sales department only, without granting tenant-wide rights. Which Entra ID feature should you use?

  1. Resource groups
  2. Management groups
  3. Access packages
  4. Administrative units Correct answer.

Explanation

Administrative units restrict directory role assignments to a subset of users or groups, enabling scoped delegation such as department-level password reset. Management groups and resource groups scope Azure resources, not directory objects.

Question 16Manage Azure identities and governance

An administrator wants to review whether users still need access to a group every quarter. Which Entra ID feature should be configured?

  1. Access reviews Correct answer.
  2. Conditional Access
  3. Password protection
  4. Entra Connect sync

Explanation

Access reviews periodically prompt reviewers to confirm or remove group and application access, supporting recertification. Conditional Access, password protection, and directory sync do not provide periodic access recertification.

Question 17Manage Azure identities and governance

A subscription must not be able to create resources outside two approved Azure regions. Which Azure Policy configuration achieves this?

  1. A policy definition with an allowed locations constraint Correct answer.
  2. A budget alert on the subscription
  3. A resource lock of type ReadOnly
  4. A Conditional Access policy

Explanation

A policy definition using the allowed locations condition restricts deployments to a defined set of regions and can deny out-of-region creation. Budgets, locks, and Conditional Access do not restrict deployment regions.

Question 18Manage Azure identities and governance

You need to grant a managed identity in one subscription access to a Key Vault in another subscription. What must be created?

  1. A role assignment on the Key Vault scope for the managed identity principal Correct answer.
  2. A resource lock on the Key Vault
  3. A management group containing only the Key Vault
  4. A new service principal secret

Explanation

Cross-subscription access is granted by creating a role assignment on the target resource's scope for the managed identity's principal ID. Locks, management groups, and secrets do not grant the required data or management permissions.

Question 19Manage Azure identities and governance

A company wants to require that all resources carry a CostCenter tag before deployment succeeds. Which policy effect should be used?

  1. Deny Correct answer.
  2. Append
  3. Disabled
  4. Audit

Explanation

The Deny effect blocks deployment of resources that do not meet the policy rule, such as missing a required tag. Audit only records noncompliance, Append adds values, and Disabled turns the policy off.

Question 20Manage Azure identities and governance

An administrator needs to move a subscription from one management group to another. What is the impact on inherited policy assignments?

  1. Policies apply only after the subscription is recreated.
  2. All policies are deleted and must be recreated.
  3. Inherited policies remain tied to the original management group.
  4. Inherited policies change to reflect the new management group hierarchy. Correct answer.

Explanation

Moving a subscription changes its position in the management group hierarchy, so inherited policies and role assignments from the new parent take effect while those from the old parent no longer apply. Directly assigned policies at the subscription remain.

Question 21Manage Azure identities and governance

Which Entra ID object represents a security identity used by an application to access Azure resources and can be assigned roles?

  1. Access package
  2. Named location
  3. Administrative unit
  4. Service principal Correct answer.

Explanation

A service principal is the local identity of an application in a tenant and can be assigned Azure RBAC roles. Administrative units scope administration, access packages bundle entitlements, and named locations are Conditional Access signals.

Question 22Manage Azure identities and governance

A team needs temporary access to a resource group for a two-week project. Which approach follows least privilege and time-bound access?

  1. Share the subscription owner credentials
  2. Assign the required role with a start and end date using PIM for Azure resources Correct answer.
  3. Create a resource lock and give no role
  4. Assign Owner permanently to the team group

Explanation

Privileged Identity Management supports eligible, time-bound Azure resource role assignments with defined start and end times. Permanent Owner assignments and credential sharing violate least privilege, and a lock grants no access.

Question 23Manage Azure identities and governance

You need to audit which users have the Global Administrator role and when the role was last activated. Which tool provides this directly?

  1. Resource Manager templates
  2. Azure Monitor metrics
  3. PIM audit history in the Entra admin center Correct answer.
  4. Azure Cost Management

Explanation

PIM audit history records role assignments, activations, and approvals for privileged roles. Cost Management, Azure Monitor metrics, and ARM templates do not report directory role activation events.

Question 24Manage Azure identities and governance

An organization wants to synchronize on-premises Active Directory users to Entra ID while keeping password hashes on-premises. Which authentication option should they choose?

  1. Password hash synchronization
  2. Cloud-only accounts
  3. Pass-through authentication Correct answer.
  4. Federated authentication with AD FS

Explanation

Pass-through authentication validates passwords against on-premises Active Directory without synchronizing password hashes to the cloud. Password hash sync uploads hashes, federation uses a separate STS, and cloud-only accounts do not sync from on-premises.

Question 25Manage Azure identities and governance

A user's access to an application must be automatically removed when their manager changes, based on a defined policy. Which Entra ID feature supports this?

  1. Resource locks
  2. Named locations
  3. Entitlement management with access packages Correct answer.
  4. Password protection

Explanation

Entitlement management access packages can include expiration and lifecycle policies that revoke access when conditions such as manager changes occur. Password protection, named locations, and resource locks do not govern application access lifecycle.

Question 26Manage Azure identities and governance

A user is assigned the Owner role at the subscription scope and the Reader role at a resource group within that subscription. What is the user's effective permission on resources in that resource group?

  1. Owner, because Azure combines all role assignments and grants the union of permissions Correct answer.
  2. Reader, because the most specific scope always overrides broader assignments
  3. Reader, because resource group assignments replace inherited subscription assignments
  4. Owner, because role assignments at a broader scope take precedence over narrower ones

Explanation

Azure RBAC permissions are additive: a principal receives the union of all permissions from every role assignment that applies, and inherited assignments from higher scopes are not overridden by narrower ones. The Owner assignment at subscription scope flows down to the resource group, so the user retains Owner there even though a Reader assignment also exists.

Question 27Manage Azure identities and governance

You need to give a partner organization's users access to resources in your tenant while their accounts remain homed in the partner's own Entra ID tenant. Which configuration should you use?

  1. A custom domain verified in your tenant
  2. Guest invitations through B2B collaboration Correct answer.
  3. Self-service password reset with writeback
  4. Directory synchronization with Entra Connect

Explanation

Entra B2B collaboration invites external users as guest objects in your tenant, and they authenticate with their home tenant credentials. This preserves their home identity while granting them access to your resources through role assignments or access packages.

Question 28Manage Azure identities and governance

An administrator must ensure that a specific application can read secrets from a key vault using its own identity, without any human credentials being stored. Which two objects are required?

  1. A user-assigned managed identity and a key vault access policy or RBAC role assignment Correct answer.
  2. An app registration client secret and a service principal password
  3. An Entra ID group and a privileged access group assignment
  4. A guest user account and a conditional access policy

Explanation

A managed identity provides an automatically managed identity for the application, and access to the key vault is granted either through the vault access policy model or an Azure RBAC role such as Key Vault Secrets User. No secret needs to be stored because the platform manages the credential.

Question 29Manage Azure identities and governance

A company wants new virtual machines to be created only in the West Europe and North Europe regions, and existing noncompliant resources should be flagged without blocking unrelated operations. Which policy effect fits?

  1. Deny
  2. Append
  3. Audit Correct answer.
  4. Modify

Explanation

The Audit effect evaluates resources against the policy rule and records a compliance event without preventing the operation. It is appropriate when the goal is to flag noncompliant resources rather than block deployment.

Question 30Manage Azure identities and governance

You are designing a governance hierarchy where a platform team applies policies at a management group and individual application teams manage their own subscriptions. What happens when a team attempts to remove an inherited policy assignment from its subscription?

  1. The team can remove it only after the management group assignment is deleted
  2. The team cannot remove it because inherited assignments are read-only at child scopes Correct answer.
  3. The team can remove it if the policy definition is a built-in definition
  4. The team can remove it because subscription owners control all assignments at their scope

Explanation

Policy assignments made at a management group are inherited by child subscriptions, and the assignment itself can only be changed or removed at the scope where it was created. Child-scope owners can see the assignment but cannot delete it.

Question 31Manage Azure identities and governance

Which Entra ID feature should you use to grant a user temporary, time-bound eligibility for the User Administrator role with approval and justification?

  1. Access reviews
  2. Privileged Identity Management Correct answer.
  3. Entitlement management
  4. Conditional Access

Explanation

Privileged Identity Management provides just-in-time role activation with approval workflows, justification, and time limits for eligible assignments. It is the feature designed for temporary elevation of directory roles and Azure resource roles.

Question 32Manage Azure identities and governance

A tenant administrator wants to require that members of a security group register for MFA within 14 days of first sign-in. Which capability enforces registration timing?

  1. Password protection custom banned list
  2. Authentication methods registration policy with a configured campaign Correct answer.
  3. Per-user MFA enabled state
  4. Security defaults

Explanation

The authentication methods registration policy can target groups and require users to register within a specified number of days, prompting them at sign-in until registration completes. This is the supported way to enforce registration deadlines.

Question 33Manage Azure identities and governance

You need to create a role assignment that allows a team to manage all resources in a subscription but prevents them from granting access to others. Which built-in role should you assign at subscription scope?

  1. Owner
  2. Contributor Correct answer.
  3. User Access Administrator
  4. Reader

Explanation

Contributor grants full management of resources but explicitly excludes the ability to create role assignments or otherwise manage access. Owner and User Access Administrator both include access management permissions.

Question 34Manage Azure identities and governance

A user-assigned managed identity in subscription A must be granted read access to a storage account in subscription B. What must be created?

  1. A role assignment at the storage account scope in subscription B for the managed identity principal Correct answer.
  2. A new managed identity in subscription B and a group membership
  3. A management group containing both subscriptions and a policy assignment
  4. A service principal secret in subscription B shared with subscription A

Explanation

Role assignments can target a principal from any tenant directory at any resource scope, so the existing managed identity can be assigned a role such as Storage Blob Data Reader directly on the storage account in subscription B. No new identity is needed.

Question 35Manage Azure identities and governance

What is the default behavior when a new user is created in Entra ID and no license is assigned?

  1. The user cannot be created until a license is assigned
  2. The user is blocked from signing in until a license is assigned
  3. The user is automatically assigned the Free tier license
  4. The user can sign in but cannot use any Microsoft 365 services Correct answer.

Explanation

User accounts exist independently of licenses; an unlicensed user can authenticate to Entra ID but has no entitlement to licensed workloads such as Exchange Online or Intune. Licenses are assigned separately through group-based or direct licensing.

Question 36Manage Azure identities and governance

An organization wants to automatically assign a set of licenses to users based on their department attribute. Which approach should be used?

  1. Manual license assignment per user
  2. Group-based licensing with a dynamic membership rule Correct answer.
  3. An access review of license assignments
  4. A conditional access policy requiring the license

Explanation

Group-based licensing assigns licenses to all members of a group, and a dynamic group with an attribute rule such as department equals Sales keeps membership current automatically. This removes manual per-user license management.

Question 37Manage Azure identities and governance

Which statement correctly describes the difference between a security group and a Microsoft 365 group in Entra ID?

  1. Microsoft 365 groups cannot be assigned roles, while security groups can be mail-enabled
  2. Security groups are always dynamic, while Microsoft 365 groups are always assigned
  3. Security groups can only contain users, while Microsoft 365 groups can only contain devices
  4. Security groups are used for access management, while Microsoft 365 groups also provide a shared mailbox Correct answer.

Explanation

Security groups are for granting access to resources and roles, while Microsoft 365 groups add collaboration resources such as a shared mailbox and calendar. Both group types can be role-assignable when created with that option.

Question 38Manage Azure identities and governance

A tenant must ensure that a deleted user account can be restored along with its assigned roles and group memberships. What should the administrator do?

  1. Restore the user from the deleted users list within the retention window Correct answer.
  2. Import the user from Entra Connect again
  3. Recreate the user with the same user principal name
  4. Assign the same licenses to a new account

Explanation

Soft-deleted users remain in the deleted users container for the retention period, and restoring from there recovers the same object with its properties and memberships intact. Recreating an account produces a new object identifier and loses prior assignments.

Question 39Manage Azure identities and governance

You need to allow users to request access to a bundle of groups and applications with an approval workflow and automatic expiration. Which Entra ID feature provides this?

  1. Application proxy
  2. Entitlement management access packages Correct answer.
  3. Conditional Access templates
  4. Privileged Identity Management

Explanation

Access packages in entitlement management bundle resources, define request and approval policies, and enforce expiration and periodic reviews. This matches the requirement for self-service request with lifecycle controls.

Question 40Manage Azure identities and governance

Which tool provides a consolidated view of sign-in activity, audit logs, and provisioning logs for an Entra ID tenant?

  1. Azure Advisor
  2. Microsoft Entra admin center monitoring reports Correct answer.
  3. Network Watcher
  4. Azure Cost Management

Explanation

The Entra admin center exposes monitoring reports for sign-ins, audit events, and provisioning, along with the ability to export logs to Log Analytics or a storage account. These reports are the primary place to investigate identity activity.

Question 41Manage Azure identities and governance

An administrator wants to require that privileged role activation occurs only from a compliant device. Which configuration enforces this?

  1. A Conditional Access policy scoped to directory roles requiring a compliant device Correct answer.
  2. An authentication strength policy applied to all users
  3. A PIM activation maximum duration setting
  4. An access review of privileged roles

Explanation

Conditional Access policies can target directory roles, so requiring a compliant device for those roles ensures role activation and use occur only from managed devices. PIM settings control duration and approval but do not evaluate device compliance.

Question 42Manage Azure identities and governance

What is the purpose of the tenant-level setting that restricts non-admin users from creating tenants?

  1. It disables self-service password reset for members
  2. It prevents users from joining guest invitations
  3. It blocks device registration for non-admins
  4. It controls whether users can create new Entra ID tenants through self-service Correct answer.

Explanation

The tenant creation setting governs whether non-admin users can create new tenants from within the organization, which affects data boundary and governance. It does not affect guest redemption, password reset, or device registration.

Question 43Manage Azure identities and governance

A subscription owner needs to grant a colleague the ability to create and manage role assignments on a specific resource group only. Which role and scope should be used?

  1. Contributor at the resource group scope
  2. Global Administrator at the tenant scope
  3. Owner at the subscription scope
  4. User Access Administrator at the resource group scope Correct answer.

Explanation

User Access Administrator grants the ability to manage role assignments without granting full resource management, and scoping it to the resource group limits the delegation to that boundary. This follows least privilege.

Question 44Manage Azure identities and governance

You need to define a reusable set of role permissions tailored to your organization that can be assigned like a built-in role. What should you create?

  1. A policy definition with a deny effect
  2. A dynamic group
  3. A custom role definition with actions and assignable scopes Correct answer.
  4. An administrative unit

Explanation

Custom roles let you specify exactly which actions and data actions are permitted, along with the scopes where the role can be assigned. They then behave like built-in roles in role assignments.

Question 45Manage Azure identities and governance

An administrator wants to delegate password reset for users in the Contoso subsidiary without granting rights over the rest of the tenant. Which approach is appropriate?

  1. Enable self-service password reset for all users
  2. Assign Global Administrator to the subsidiary's IT lead
  3. Create a dynamic group and assign the Helpdesk Administrator role to it
  4. Create an administrative unit containing those users and assign a scoped role there Correct answer.

Explanation

Administrative units restrict the scope of directory role assignments to the objects placed in the unit, so a scoped Helpdesk or User Administrator role can reset passwords only for those users. This limits blast radius compared with tenant-wide roles.

Question 46Manage Azure identities and governance

Which Azure construct provides a billing and security boundary and contains resource groups and resources?

  1. Tenant
  2. Resource group
  3. Management group
  4. Subscription Correct answer.

Explanation

A subscription is the unit of billing and access management boundary that contains resource groups and their resources. Management groups organize subscriptions, and resource groups are containers within a subscription.

Question 47Manage Azure identities and governance

You need to move a resource group from one subscription to another. What must be verified before the move?

  1. That the resource group has no role assignments
  2. That the destination subscription has no resource groups yet
  3. That the source and destination subscriptions are in the same Entra ID tenant and the resources support move Correct answer.
  4. That both subscriptions have the same billing account

Explanation

Resource and resource group moves require both subscriptions to be associated with the same tenant, and each resource type must support being moved. Role assignments on resources are not carried over automatically and must be recreated.

Question 48Manage Azure identities and governance

A team reports that an Azure Policy assignment is not preventing noncompliant deployments even though the definition is assigned. Which condition would explain this?

  1. The policy uses the Audit effect
  2. The policy assignment has enforcement mode disabled Correct answer.
  3. The assignment scope includes a resource group
  4. The policy definition is a built-in definition

Explanation

When enforcement mode is disabled, the policy is evaluated and compliance is recorded, but deny and other blocking effects are not enforced. Re-enabling enforcement restores the blocking behavior.

Question 49Manage Azure identities and governance

Which Entra ID capability lets you require that administrative actions in the directory be reviewed by a second administrator before taking effect?

  1. Privileged Identity Management activation with approval Correct answer.
  2. Conditional Access with a terms of use
  3. Access reviews with auto-apply
  4. Identity Protection risk policies

Explanation

PIM approval workflows require a designated approver to authorize an activation request before the role becomes active, adding a second-person check for privileged actions. Access reviews and risk policies serve different purposes.

Question 50Manage Azure identities and governance

An organization wants to ensure that when an employee leaves, their access to all assigned applications is removed at the same time as their account. Which configuration supports this?

  1. Lifecycle workflow triggered on the employee leave event Correct answer.
  2. An access review with a quarterly schedule
  3. A dynamic group based on the department attribute
  4. A conditional access policy requiring MFA

Explanation

Lifecycle workflows in Entra ID Governance can trigger on events such as employee leave and run tasks that remove group memberships, revoke access, and disable accounts. This automates offboarding without manual follow-up.