Question

Contoso uses Entra ID entitlement management. Users who already have the 'Finance-Payroll' access package assigned must never be allowed to request the new 'Finance-Audit' access package, because holding both violates a segregation-of-duties control. You want to enforce this automatically at request time without relying on manual approver review. What should you configure on the 'Finance-Audit' access package?

Accepted Answer

Add an incompatible access package under the access package's Separation of duties settings, specifying 'Finance-Payroll'.

Answer

Create a Conditional Access policy that blocks users assigned to Finance-Payroll from the Finance-Audit application.

Answer

Configure a recurring access review on Finance-Audit that removes any user who also holds Finance-Payroll.

Answer

Set the Finance-Audit request policy to require approval from the Finance-Payroll package owner.