Task 4.1: Plan and implement entitlement management in Microsoft Entra

• AIn each access package policy's expiration settings

  Incorrect

  The policy's expiration ends the assignment; what happens to the guest account afterwards is a separate setting.

• BIn a recurring access review of all guest users with auto-apply turned on

  Incorrect

  A review acts on its own schedule and decisions, not when an assignment expires.

• CIn the external collaboration settings for guest user access restrictions

  Incorrect

  Those settings limit what guests can see in the directory; they don't remove accounts.

• DIn entitlement management's settings for managing the lifecycle of external users

  Correct

  These settings block sign-in and remove the guest a set number of days after the last assignment ends.

By default, a guest invited through entitlement management who loses their last access package assignment is blocked from signing in and removed after 30 days. The Manage the lifecycle of external users settings change this: block sign-in, remove the account, and the number of days before removal.

• AIdentity Governance Administrator at tenant scope

  Incorrect

  This directory role manages entitlement management across every catalog.

• BCatalog owner on the Marketing catalog

  Incorrect

  Catalog owners can also add resources and add other catalog owners.

• CCatalog creator

  Incorrect

  This tenant-level role grants no rights inside the existing Marketing catalog.

• DAccess package manager on the Marketing catalog

  Correct

  It creates and manages access packages, policies, requests and assignments in that catalog only.

Entitlement management has catalog-level roles. A catalog owner manages the catalog, its resources and its roles, while an access package manager creates and manages access packages, policies, requests and assignments within the catalog, using the resources already in it.

• AAn approval stage on Invoice-Pay where the manager rejects conflicting requests

  Incorrect

  Approvers would have to spot every conflict by hand.

• BInvoice-Approve marked as an incompatible access package on Invoice-Pay

  Correct

  Separation of duties checks stop users with an incompatible package from requesting the other one.

• CA quarterly access review of Invoice-Pay that flags holders of Invoice-Approve

  Incorrect

  A review finds conflicts after access was granted, not at request time.

• DA Conditional Access policy that blocks Invoice-Pay's resources for the Invoice-Approve group

  Incorrect

  Conditional Access governs sign-in to apps, not who may request an access package.

An access package can list incompatible access packages or groups. Users who already hold an incompatible assignment or membership can't request the package, which enforces separation of duties at request time.

• AA custom branding sign-in page text containing the agreement

  Incorrect

  Branding text is shown, not accepted or tracked, and can't be required every 90 days.

• BAn access package policy that requires the agreement as a requestor question

  Incorrect

  A requestor question is answered once per request, not every 90 days for every app.

• CA terms of use with Duration before re-acceptance required set to 90 days, required by a Conditional Access policy for guests

  Correct

  Terms of use set re-acceptance intervals, and a Conditional Access grant control enforces them at sign-in.

• DA Conditional Access sign-in frequency of 90 days for guests

  Incorrect

  Sign-in frequency forces reauthentication; it doesn't present or record an agreement.

Microsoft Entra terms of use can expire consents on a schedule or require re-acceptance after a set number of days. A Conditional Access policy that targets guests with the terms of use as a grant control makes acceptance a condition of access.

• AAzure subscriptions, resource groups and VMs

  Incorrect

  Azure resource roles are managed with PIM, not access packages.

• BGroups, applications and SharePoint Online sites

  Correct

  These are the resource types catalogs and access packages work with.

• COnly Microsoft 365 groups

  Incorrect

  Security groups, apps and sites can be added too.

• DConditional Access policies and named locations

  Incorrect

  Policies aren't resources that users are assigned to.

Entitlement management catalogs hold groups (cloud-created Microsoft 365 or security groups), applications integrated with Microsoft Entra ID, and SharePoint Online sites. Access packages assign users to resource roles from these resources.

• AAccess packages accept only Microsoft 365 groups, not security groups of any kind

  Incorrect

  Cloud-created security groups are accepted too.

• BThe group needs at least 50 members first

  Incorrect

  There's no minimum membership for resources.

• CIts membership is mastered on premises, so Microsoft Entra ID can't change it

  Correct

  Groups that originate in on-premises AD can't be assigned as resources.

• DSynced groups need a P2 license per member

  Incorrect

  Licensing isn't the reason.

Groups that originate in on-premises Active Directory can't be access package resources because their owner and member attributes can't be changed in Microsoft Entra ID.

• AManage every catalog in the tenant

  Incorrect

  Catalog creators can't manage or see catalogs they don't own.

• BAdd any group in the tenant to a catalog

  Incorrect

  The role is for creating catalogs, not for adding any group in the tenant.

• CCreate catalogs, becoming each one's first owner

  Correct

  The creator of a catalog is its first catalog owner.

• DApprove every access package request

  Incorrect

  Approvers are set per policy, not by this role.

Catalog creators create and manage catalogs. The person who creates a catalog becomes its first catalog owner, but can't manage or see catalogs they don't own.

• AA custom extension that runs a Logic App from the access package policy

  Correct

  Custom extensions launch Logic Apps at stages such as request or assignment.

• BA lifecycle workflow triggered by the user's hire date

  Incorrect

  Lifecycle workflows react to joiner, mover and leaver events, not access package grants.

• CA dynamic group rule that adds users who hold the package to the SaaS app

  Incorrect

  Dynamic rules evaluate user attributes, not package assignments, and can't call apps.

• DA Conditional Access policy for the SaaS app

  Incorrect

  Conditional Access evaluates sign-ins; it doesn't run workflows.

Entitlement management custom extensions link Azure Logic Apps to catalogs and access packages. Rules in an access package policy trigger them at stages such as when access is requested or granted, for example to update a SaaS app or send custom email.