Microsoft Certified: Azure Security Engineer AssociateManage identity and accessMedium
A global consulting firm uses Azure AD. They need to ensure that external contractors can access specific project-related resources in Azure AD, but their access must be automatically revoked after 90 days. The contractors do not have accounts in the firm's on-premises Active Directory. Which Azure AD feature should be used to manage this requirement?
- AAzure AD Conditional Access
- BAzure AD Privileged Identity Management (PIM)
- CAzure AD Identity Governance Access Reviews
- DAzure AD B2B collaboration
Show answer & explanationAnswer & explanation
Correct answer: D. Azure AD B2B collaboration
Azure AD B2B collaboration allows you to invite external users (contractors) to your Azure AD tenant as guest users. When inviting these users, you can configure an access package through Azure AD Entitlement Management (which integrates with B2B) to automatically revoke access after a specified period, such as 90 days.
Why the other options are wrong
- A. Conditional Access enforces policies based on conditions but does not directly manage the lifecycle of external user accounts or their automatic revocation after a duration.
- B. PIM manages just-in-time and just-enough access for privileged roles, not general external user lifecycle management.
- C. Access Reviews are for periodically reviewing existing access, not for initially provisioning and automatically revoking access for new external users based on a time limit.
Azure AD B2B Collaboration
Enables organizations to securely collaborate with external users by inviting them to use their own identities to access resources.
- External users are guest accounts.
- Supports various identity providers.
- Integrates with Entitlement Management for lifecycle.
Memory trick: B2B: Bring External, Bound by Time.