A company is managing external guest users in Microsoft Entra ID. They want to ensure that guest users automatically lose access to all company resources after 90 days, unless their access is explicitly renewed. Which Microsoft Entra ID governance feature should be configured?
- AMicrosoft Entra Access Reviews with guest user settings
- BMicrosoft Entra Privileged Identity Management (PIM)
- CMicrosoft Entra Conditional Access policies
- DMicrosoft Entra Entitlement Management
Show answer & explanationAnswer & explanation
Correct answer: A. Microsoft Entra Access Reviews with guest user settings
Microsoft Entra Access Reviews can be configured to manage guest user access. Specifically, a recurring access review can be set up for guest users, with an automatic action to remove users if they are not reviewed or approved within a specific timeframe (e.g., 90 days). This directly addresses the requirement for time-limited guest access with automatic removal unless renewed.
Why the other options are wrong
- B. PIM manages privileged roles for internal users, not automatic lifecycle for guest access.
- C. Conditional Access enforces policies at sign-in but doesn't automatically revoke access based on a time limit for guest accounts.
- D. Entitlement Management helps manage access requests and assignment, but Access Reviews are specifically for periodic validation and removal of existing access.
Microsoft Entra Access Reviews for Guests
Microsoft Entra Access Reviews allow organizations to efficiently manage group memberships, access to enterprise applications, and role assignments by regularly reviewing who has access.
- Can be configured to review guest user access periodically.
- Enables automatic removal of guest users who are not approved.
- Helps ensure compliance and reduces stale access for external users.
Memory trick: Access Reviews review who stays, PIM is for privileged ways, Entitlement Management grants, Conditional Access commands.