Question

Contoso partners with several external vendors whose employees are added as guest users in Contoso's Microsoft Entra tenant. Compliance requires that vendor access to sensitive resource groups be re-validated by the sponsoring department manager every 90 days, and access must be automatically removed if the manager does not respond. The solution must minimize administrative effort and avoid custom scripting. What should you recommend?

Accepted Answer

Configure Microsoft Entra access reviews with recurring quarterly reviews, assign the reviewers to be the resource owners/sponsors, and set the auto-apply action to remove access if reviewers don't respond

Answer

Create an Azure Automation runbook that queries guest sign-in logs every 90 days and deletes accounts with no recent activity

Answer

Enable Microsoft Entra Privileged Identity Management (PIM) with a 90-day maximum activation duration for each guest's role assignment

Answer

Apply an Azure Policy that denies role assignments to guest users on the sensitive resource groups after 90 days