Question

Contoso wants a business unit lead named Priya to be able to create and manage access packages for her department, including adding her own team's groups and SharePoint sites as resources. She should NOT be able to create new catalogs or manage resources in other departments' catalogs. Following least privilege, how should you configure this in entitlement management?

Accepted Answer

Create a catalog for the department, add Priya as a Catalog owner, and have her add the department's resources to that catalog

Answer

Assign Priya the Identity Governance Administrator role at the tenant level

Answer

Add Priya to the Catalog reader role on the department catalog and grant her the User Administrator role

Answer

Assign Priya the Access package manager role on a shared organization-wide catalog