MDFT Pro, a well-known training agency, has an Azure subscription that contains a custom application named Application1. The application was developed by an external company that was assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan.
You need to recommend a solution to verify whether the external developers still require permissions to Application1. The solution must meet the following requirements:
- Send a monthly email message to the manager of the developers that lists the access permissions to Application1.
- If the manager does not verify an access permission, automatically revoke that permission.
- Minimize development effort.
What should you recommend?
In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources is incorrect. PIM custom role assignments provide just-in-time access and activation workflows but do not send monthly email reports to managers or automatically revoke unverified permissions.
Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet is incorrect. An Automation runbook running Get-AzRoleAssignment would list RBAC assignments but requires custom development to email managers, track responses, and revoke access, violating the minimize development effort requirement.
Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet is incorrect. An Automation runbook running Get-AzureADUserAppRoleAssignment retrieves app role assignments but would require significant custom logic to implement the email verification and auto-revocation workflow.
In Azure Active Directory (Azure AD), create an access review of Application1 is correct. Azure AD access reviews provide built-in functionality to periodically email managers to verify access permissions and automatically revoke unapproved permissions, meeting all requirements with minimal development effort.