Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A company uses Microsoft Entra ID and has configured several access packages in entitlement management. They need to ensure that users who have been granted access through these packages still require that access. The security team wants an automated process to periodically verify access and automatically remove it if no justification is provided or if approvers deny the access during the review. Which component of entitlement management should be configured to meet these requirements?
- AAccess package policy expiration settings
- BConnected organizations
- CAccess reviews for access packages
- DAccess package catalog
Show answer & explanationAnswer & explanation
Correct answer: C. Access reviews for access packages
Access reviews within entitlement management allow for periodic verification of access and can be configured to automatically remove access if reviewers don't respond or deny the access.
Why the other options are wrong
- A. Expiration settings automatically remove access after a set time, but don't involve periodic verification by users or approvers.
- B. Connected organizations define external organizations whose users can request access packages; they don't manage access verification.
- D. An access package catalog is a container for access packages and resources; it doesn't manage access verification.
Access Reviews
A Microsoft Entra ID feature for managing group memberships, access to enterprise applications, and role assignments, ensuring users still need the access they have.
- Automates the process of reviewing user access.
- Can be configured for groups, applications, and privileged roles.
- Supports automatic removal of access for non-responders or denied reviews.
Memory trick: Access Reviews are like regular audits of who still needs their key.