Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceHard
A global enterprise is implementing a new access governance strategy. They need to ensure that the management of access packages is decentralized to departmental IT teams, but with a global oversight. Each departmental IT team should be able to create and manage their own access packages and policies, but not modify those of other departments. Which entitlement management role should be assigned to the departmental IT leads to grant them these specific permissions?
- AAccess package manager
- BCatalog owner
- CAccess review administrator
- DGlobal administrator
Show answer & explanationAnswer & explanation
Correct answer: B. Catalog owner
The 'Catalog owner' role allows departmental IT leads to create and manage all access packages and policies within a specific catalog. By assigning them as owners of their respective departmental catalogs, they gain decentralized control without affecting other departments, while still allowing for global oversight by those with higher roles.
Why the other options are wrong
- A. Access package manager can only manage *existing* access packages, not create new ones or manage catalog settings.
- C. Access review administrator manages access reviews, which is a different aspect of governance and not related to creating/managing access packages.
- D. Global administrator has too broad permissions, granting control over all catalogs and other Entra ID settings, which is not desired for decentralized departmental control.
Entitlement Management Catalog Owner
A role in Microsoft Entra entitlement management that grants full administrative control over a specific access catalog, enabling decentralized management of access packages and policies.
- Can create, update, and delete access packages within their catalog.
- Can manage policies and resources for access packages in their catalog.
- Provides a scope for delegated administration, avoiding Global Administrator permissions.
Memory trick: Catalog owner holds the keys to their domain.