Question

Contoso uses Entra ID entitlement management to grant access to a collection of resources through a single access package named 'Project Falcon Resources'. The security team requires that internal employees can self-request access with no approval and a 90-day review, while external users from partner organizations must be sponsored, require two-stage approval, and expire after 30 days. Both groups must use the same underlying resources in the access package. What is the correct way to configure this?

Accepted Answer

Create a single access package with two separate assignment policies — one scoped to internal users and one scoped to external (connected organization) users — each with its own approval, expiration, and review settings.

Answer

Create two separate access packages, one for internal users and one for external users, each referencing the same catalog resources.

Answer

Create a single access package with one assignment policy and use a dynamic membership rule to apply different approval settings based on the userType attribute.

Answer

Create a single access package with one assignment policy and configure separation of duties to differentiate internal from external requestors.