Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceHard
A multinational corporation uses Microsoft Entra ID and has delegated the management of specific access packages to departmental managers. These managers need the ability to create new access packages, assign resources, and configure policies for their respective departments, but they should not be able to manage access packages that belong to other departments or modify global entitlement management settings. Which Microsoft Entra role should be assigned to these departmental managers?
- AIdentity Governance Administrator
- BAccess package manager
- CCatalog owner
- DGlobal Administrator
Show answer & explanationAnswer & explanation
Correct answer: C. Catalog owner
A Catalog owner can create and manage access packages within a specific catalog, assign resources to a catalog, and define policies, but they cannot manage access packages in other catalogs or modify global entitlement management settings. This aligns perfectly with the principle of least privilege for departmental delegation.
Why the other options are wrong
- A. Identity Governance Administrator has global permissions across all identity governance features, including entitlement management, which is too broad.
- B. Access package manager has narrower permissions, primarily to manage existing access packages, but not necessarily to create new ones or manage the catalog itself.
- D. Global Administrator has full control over all Entra ID settings, which violates the principle of least privilege for this scenario.
Entitlement Management Catalog Owner
A role in Microsoft Entra Entitlement Management that allows a user to manage all aspects of a specific catalog, including creating and managing access packages, resources, and policies within that catalog.
- Scoped to a specific catalog.
- Can create/manage access packages and policies.
- Cannot manage other catalogs or global settings.
Memory trick: The 'Catalog Owner' keeps their own 'departmental' access and policies sewn.