Microsoft AB-650 Exam - Topic 3 Question 1 Discussion

Microsoft Entra ID Governance provides entitlement management through access packages, enabling organizations to automate access requests, approvals, assignments, and expiration.

Option A is correct because access packages support both required capabilities: self-service access requests with approval and automatic revocation when the approved assignment expires.

Administrators can create an access package containing the resources or groups that grant access to Agent1. They then configure an assignment policy that allows eligible contractors to request access.

On the policy's Requests settings, administrators can enable approval and designate the appropriate approvers. This ensures that contractors cannot receive access without authorization.

On the Lifecycle settings, administrators can configure access package assignments to expire after a specified number of days. Setting the duration to 30 days automatically ends the assignment at the end of the project.

Option B is incorrect because PIM primarily manages just-in-time privileged role and group access, rather than the complete self-service entitlement management process requested.

Option C is incorrect because Conditional Access evaluates access conditions but does not independently provide request approval and assignment expiration.

Option D is incorrect because recurring access reviews periodically assess existing access instead of providing the required initial request-and-approval workflow.

Therefore, an access package meets both requirements.

Microsoft Reference:

https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-approval-policy

https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-lifecycle-policy