Question

Your organization uses Entra ID entitlement management. The central identity team owns the top-level configuration, but a project lead named Dana in the Marketing department needs to create and manage access packages that grant access only to a specific set of Marketing SharePoint sites and groups. Dana must NOT be able to add resources from outside Marketing, and she must not be granted any tenant-wide administrative role. What should you do to enable this with least privilege?

Accepted Answer

Create a dedicated catalog containing only the Marketing resources, then add Dana as a Catalog owner.

Answer

Assign Dana the Identity Governance Administrator role so she can manage access packages.

Answer

Add Dana as an Access package manager on the default General catalog.

Answer

Assign Dana the Groups Administrator role and let her create access packages from the General catalog.