Question

Contoso uses entitlement management to grant contractors access to a project SharePoint site through an access package. The security team requires that contractor access automatically ends after 90 days unless the contractor's manager approves an extension, and that the manager must reconfirm justification at the time of any extension. Which access package policy configuration meets these requirements with the least administrative effort?

Accepted Answer

Set the access package assignment to expire after 90 days, enable 'Allow users to extend access,' and require approval with a manager as the first-stage approver plus a justification requirement.

Answer

Configure a recurring quarterly access review of the access package assignments with the manager as reviewer and auto-remove denied users.

Answer

Create a Conditional Access policy that blocks contractor sign-ins after 90 days and requires a helpdesk ticket to unblock.

Answer

Set the assignment to never expire and rely on the connected organization's lifecycle settings to remove access after 90 days.