Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A company is implementing a new access governance strategy using Microsoft Entra ID. They have identified several critical applications that require strict control over who can request access. They want to delegate the creation and management of access packages for these applications to specific department heads, ensuring that these department heads can only manage access packages for their own departments' resources and not other departments'. Which Microsoft Entra ID role should be assigned to the department heads to achieve this granular delegation?
- AGlobal Administrator
- BUser Administrator
- CCatalog creator
- DAccess package manager
Show answer & explanationAnswer & explanation
Correct answer: C. Catalog creator
The Catalog Creator role allows users to create and manage catalogs, which are logical containers for access packages. By creating separate catalogs for each department, department heads can be assigned Catalog Creator for their specific catalog, thus granting granular control over their department's access packages and resources.
Why the other options are wrong
- A. Global Administrator grants full control over all Microsoft Entra ID resources, which is too broad and violates the principle of least privilege.
- B. User Administrator manages user and group properties, not access packages or resource delegation.
- D. Access package manager can manage existing access packages within a specific catalog but cannot create new catalogs, which is necessary for departmental segregation.
Entitlement Management Roles
Specific roles within Microsoft Entra ID that delegate administrative responsibilities for managing access packages, catalogs, and related resources.
- Catalog Creator: Can create and manage catalogs.
- Catalog Owner: Can manage existing catalogs and add/remove resources.
- Access package manager: Can manage access packages within a catalog.
Memory trick: Delegation in entitlement management is like assigning specific 'department chiefs' to manage their own resource 'sections'.