Question

Contoso partners with several external engineering firms whose staff need time-limited access to a specific set of Azure AD-integrated applications, a SharePoint site, and a security group. Each partner engagement lasts about six months. The identity team wants a self-service request workflow where a partner's designated sponsor approves access, access automatically expires at the end of the engagement, and periodic reviews confirm continued need — all without manually creating individual guest accounts and assignments. Which Microsoft Entra ID capability should you recommend?

Accepted Answer

Configure Microsoft Entra Entitlement Management access packages with connected organizations, an approval policy, and an expiration/access review lifecycle

Answer

Create a Conditional Access policy that grants the external users access based on their device compliance state

Answer

Enable Privileged Identity Management (PIM) and assign the external users eligible roles that require activation

Answer

Use a dynamic security group with membership rules based on the userType attribute equal to Guest