Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceEasy
A global conglomerate uses Microsoft Entra ID and has several business units, some of which operate as separate Microsoft Entra tenants. They want to implement entitlement management to allow users from these other internal Microsoft Entra tenants to request access to specific resources hosted in the main corporate tenant. The goal is to avoid manual guest invitations for each user and enable self-service access requests. Which entitlement management concept is most suitable for this scenario?
- APIM for Groups
- BDynamic groups
- CConnected organizations
- DAccess packages for internal users
Show answer & explanationAnswer & explanation
Correct answer: C. Connected organizations
Connected organizations in entitlement management are specifically designed to enable collaboration with external Microsoft Entra tenants (or other directories). They allow users from those tenants to request access to resources in your tenant via access packages, eliminating the need for individual guest invitations.
Why the other options are wrong
- A. PIM for Groups manages privileged access to groups within a single tenant, not cross-tenant access requests for general resources.
- B. Dynamic groups manage group membership based on attributes, not external tenant access requests.
- D. While access packages are used, the key is enabling *external* users from *other tenants* to request them, which requires connected organizations.
Entitlement Management Connected Organizations
A feature in Microsoft Entra entitlement management that allows collaboration with external partners by enabling users from their directories (e.g., other Microsoft Entra tenants) to request access to resources.
- Facilitates external collaboration.
- Supports Microsoft Entra and other directories.
- Enables self-service access requests for external users.
Memory trick: Connected Orgs Bridge Tenants Smoothly.