Question

A global manufacturing company uses Entra ID entitlement management with access packages to grant project-based access to internal employees and external partners. Compliance auditors require that access to sensitive engineering resources be recertified quarterly, that stale partner access be automatically removed after 90 days of no project activity, and that resource owners (not IT) approve continued access. As the security architect, which design best meets these requirements with the least ongoing administrative effort?

Accepted Answer

Configure access reviews on the access packages with a recurring quarterly schedule, assign resource owners as reviewers, enable auto-apply of results, and set access package assignment expiration of 90 days requiring re-request.

Answer

Create a Conditional Access policy that blocks access to engineering resources after 90 days and require a global administrator to manually re-grant access each quarter.

Answer

Use PIM for Groups to make all engineering resource access eligible, requiring users to activate every 90 days with approval from IT administrators.

Answer

Export sign-in logs to a SIEM quarterly and have the compliance team manually identify and remove inactive partner accounts via PowerShell scripts.