Question

A financial services company must ensure that every external contractor and internal employee explicitly accepts a legal disclaimer before accessing a sensitive expense-reporting application. Auditors require a record proving each user consented to the current version of the disclaimer, and consent must be re-collected whenever the legal text is updated. The solution must integrate with the existing Microsoft Entra ID sign-in experience without custom code. What should you recommend?

Accepted Answer

Configure a Microsoft Entra Terms of Use policy with a document attached, enforced through a Conditional Access policy targeting the application, and enable expiration/re-acceptance on new versions.

Answer

Add a custom claim to the application's SAML token that records a boolean acceptance flag stored in each user's extension attribute.

Answer

Create an Azure Policy definition that audits whether users have accepted the disclaimer and generate a compliance report from the results.

Answer

Use Microsoft Entra entitlement management access packages with an approval workflow requiring the legal team to approve each request.