AZ-305 Practice Question 32: Partner Access Lifecycle
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 4 · question 2 of 10
Three partner firms are joining a consortium project. About 400 of their engineers need the same bundle of access: membership of one security group, assignment to two enterprise applications, and membership of a SharePoint Online site. The design must ensure that:
- an engineer requests the bundle themselves and a manager at their own firm approves it, - access expires automatically after at most 180 days unless it is renewed, - an approved engineer who is not yet in the directory is invited automatically, and their guest account is removed when they have no remaining assignments, - the consortium's IT team does not invite, assign, or clean up accounts by hand.
Which solution should you recommend?
Show answer and explanation
Answer:
Entitlement management automates access request workflows, assignments, reviews, and expiration. An access package is a bundle of exactly the resource types this scenario lists: security group membership, enterprise application assignment, and SharePoint Online site membership, and its policy defines who may request it, who approves, and how long the assignment lasts before it expires. Connected organizations cover the last requirement: when someone not yet in the directory requests access and is approved, they are automatically invited, and when their access expires with no other assignments their B2B account can be removed automatically.
Option A automates only the first step and leaves the governance to human discipline. Nothing expires, nobody at the partner firm approves, and the quarterly manual review is the recurring effort the requirements rule out.
Option C solves membership, not lifecycle. A dynamic group adds every matching guest unconditionally (there is no request, no approval, and no expiry), and it still assumes some other process invited the guests in the first place.
Option D applies the right idea at the wrong granularity. PIM for Groups makes a user eligible to activate a membership for a short session; it governs *privileged* elevation rather than project-length access to a bundle of applications and sites, and it does not invite external users or clean up their accounts.
Reference: What is entitlement management?