Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantMedium
A Microsoft 365 administrator is managing user accounts. They need to create a new user account for a contractor who requires access to specific Microsoft 365 services for a limited period. The contractor's access should automatically expire after 90 days. Which type of user account should the administrator create to meet this requirement efficiently?
- ASynchronized user from on-premises Active Directory
- BCloud-only user with a custom PowerShell script for deactivation
- CGuest user with an access package via Azure AD Entitlement Management
- DMember user with a manual expiration date
Show answer & explanationAnswer & explanation
Correct answer: C. Guest user with an access package via Azure AD Entitlement Management
Guest users, combined with Azure AD Entitlement Management and access packages, provide an efficient way to onboard external users, grant them access to specific resources, and automatically revoke that access after a set time, such as 90 days, without manual intervention.
Why the other options are wrong
- A. Synchronized users are internal users whose accounts are managed on-premises, not typically for temporary external contractors.
- B. A custom PowerShell script would be a manual and less efficient solution compared to native Entitlement Management features.
- D. Member users are typically for internal employees, and setting a manual expiration date would require ongoing manual management.
Azure AD Entitlement Management
A feature of Azure Active Directory Identity Governance that enables organizations to manage identity and access lifecycles at scale, by automating access requests, approvals, and reviews.
- Automates access lifecycle for internal and external users.
- Uses access packages to bundle resources.
- Supports timed access with automatic expiration.
Memory trick: Grant temporary access with Entitlement Management, like a guest pass with an expiry date.