Question

A financial services company must satisfy an internal audit requirement stating that all users assigned privileged Azure AD (Microsoft Entra ID) directory roles, such as Global Administrator and User Administrator, be validated by their manager every 30 days. Assignments that are not explicitly approved during the validation cycle must be automatically removed, and all decisions must be captured for the auditors. The company has Microsoft Entra ID P2 licensing. Which solution should you recommend?

Accepted Answer

Configure a recurring access review in Microsoft Entra ID Governance scoped to the privileged directory roles, set the reviewers to managers, and set the auto-apply action to remove access when no decision is made.

Answer

Enable Privileged Identity Management (PIM) eligible assignments for the roles and require activation with MFA and approval each time a role is used.

Answer

Create an Azure Policy assignment that audits privileged role membership and triggers a remediation task to remove stale assignments.

Answer

Configure a Conditional Access policy that requires re-authentication every 30 days for users holding privileged roles.