Question

Contoso uses entitlement management to grant contractors access to a project SharePoint site and a security group through a single access package. Compliance requires that every 90 days, the resource owners re-confirm that each contractor still needs the access, and any access not confirmed within 14 days must be automatically removed. You want to configure this with the least administrative effort. What should you do?

Accepted Answer

Enable an access review within the access package's assignment policy, set it to recur quarterly with resource owners as reviewers, and configure the review to automatically apply results, removing access if reviewers don't respond.

Answer

Set the access package assignment policy expiration to 90 days so assignments lapse and contractors must submit a new access request each quarter.

Answer

Create a standalone access review targeting the security group only, with a quarterly recurrence and auto-apply enabled.

Answer

Configure a PIM for Groups access review on the security group so eligible members are re-approved every 90 days.