Question

Contoso uses Entra ID entitlement management. The security team requires that a specific access package intended for external partners can only grant access to two SharePoint Online sites and one enterprise application—no other tenant resources should ever be selectable when building this package. Additionally, the package must be manageable by a partner-relations manager who is NOT a Global Administrator. What must you configure to meet BOTH requirements with the least privilege?

Accepted Answer

Create a dedicated catalog, add only the two SharePoint sites and the enterprise application as catalog resources, and assign the partner-relations manager the Catalog owner role on that catalog.

Answer

Add all resources to the default General catalog and grant the partner-relations manager the Global Administrator role so they can build the access package.

Answer

Create the access package in the General catalog, then use an access review to remove any unintended resources after the package is published.

Answer

Assign the partner-relations manager the Identity Governance Administrator role and add resources at the access package level rather than the catalog level.