Exam AZ-304 topic 2 question 43 discussion

Given Answer is correct- here is the explanation - https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#when-should-you-use-access-reviews

I think it's D. Privileged Identity Management allows to create access reviews in order to check role assignments. Access reviews in Identity Governance allows to review groups and application assignments. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-start-access-review

"access review" is for group members, access package review. This is for common user review not privileged users review.. "PIM Azure AD roles" is for privileged administrator role's review "PIM Azure resource" is for Azure RBAC roles review. The correct answer should be "PIM Azure resource" review. Since there is no such answer,, the given answer is the closest one.

D. The question is poorly written or the interface has changed. Subscription & Resource Group access reviews are under PIM, and there are two ways to get to them. These are different than the normal access reviews listed in answer B, which are "Team + Group" access reviews. Option 1 - AD Privileged Identity Management, Azure Resources, select the subscription or management group, then Access Reviews. Option 2 - Azure Active Directory, Identity Governance, Privileged Identity Management - Azure Resources, select the subscription or management group, then Access Reviews. If you simply went to Azure Active Directory, Identity Governance, Access Reviews, you would only be able to use "Team + Group" or "Applications", and not the subscription or resource groups which this question is describing. Hope this helps.

D. Access reviews for "Groups", use AD Identity Governance. Access review for "roles", use Azure AD Privileged Identity Management (PIM). Reviewed in the portal and this is correct. https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

PIM for Azure resources (based on RBAC) is best option here.

Guys (Gals), it's PIM. Proven in my tenant. If you go into "AAD > Identity Governance > Privileged Identity Governance > Azure Resources > Discover Resources", you can select the subscription to manage access reviews on. I'm thinking that this question has some older content, but it's still valid.

https://docs.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview

For Azure AD roles or ARM roles we use PIM for the App/Group we use access review so D is the correct answer

'C'. See the question & answer for Examtopics 303 Question #4Topic 2 HOTSPOT - You plan to implement an access review to meet the following requirements: shows the section for time and access revoke rule.

Access reviews is the simplest method for recurring review of access permissions and it allows the person to approve/deny.

B is the right answer

https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

In PIM can select more subscriptions https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review#create-access-reviews " 4)For Azure AD roles, select Azure AD roles again under Manage. For Azure resources, select the subscription you want to manage." Identity Goverance doesn't.. but works with a subscription scope

Have reviews recur periodically: You can set up recurring access reviews of users at set frequencies such as weekly, monthly, quarterly or annually, and the reviewers will be notified at the start of each review. Reviewers can approve or deny access with a friendly interface and with the help of smart recommendations source https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#when-should-you-use-access-reviews

I believe it is D (Access review through PIM) since it can do Azure resource role checks and provide an automatic way to repeat them every month. It can also automatically remove access https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-create-azure-ad-roles-and-resource-roles-review

Correct Answer