AZ-305 Question 54
Select 2Your organization has onboarded several external vendors who need temporary access to specific internal applications. You want to ensure that external user access is granted for a limited duration and is periodically reviewed to maintain the principle of least privilege. Which combination of features can address these requirements?
- A
Implement Azure AD B2C to handle all external partner identity lifecycles
- B
Use Azure AD Entitlement Management to define access packages with an access expiration date
- C
Leverage Azure AD Access Reviews to periodically recertify external user access
- D
Configure Azure AD Connect to synchronize external vendor identities from an on-premises environment
Show answer and explanation
Correct answers: B, C
Explanation
To govern external access effectively, you must ensure that identity governance features both provision and periodically validate user access. Entitlement Management allows you to set up access packages with defined lifespans for external users, and Access Reviews ensures those permissions remain valid. These tools are documented in Microsoft’s official Identity Governance guidance for Azure AD: https://learn.microsoft.com/azure/active-directory/governance/.
- A. Incorrect.
Option 1 (Implement Azure AD B2C...) - INCORRECT. While Azure AD B2C is effective for consumer-facing applications, it does not natively provide time-bound or review-based access governance for external vendors within an organization’s internal tenant.
- B. Correct.
Option 2 (Use Azure AD Entitlement Management...) - CORRECT. Entitlement Management enables the creation of access packages that include different resources and policies, ensuring that external users can be given time-bound access. It is designed specifically for scenarios involving external collaborators.
- C. Correct.
Option 3 (Leverage Azure AD Access Reviews...) - CORRECT. Access Reviews allow administrators and resource owners to regularly evaluate whether external users still require their assigned roles. This feature helps organizations maintain least privilege by revoking access if it is no longer needed.
- D. Incorrect.
Option 4 (Configure Azure AD Connect...) - INCORRECT. Azure AD Connect is used primarily to synchronize directory objects from on-premises AD to Azure AD. It does not inherently manage temporary or periodically reviewed access for external vendors.