Quick Note — Recommend a Solution for Identity Governance
AZ-305 › Unit 1 › Design governance › Recommend a solution for identity governance
Quick Note — Recommend a Solution for Identity Governance
This lesson is about Microsoft Entra ID Governance — the control plane that decides who gets what access, for how long, and under what conditions. We cover Privileged Identity Management (PIM), access reviews, Entitlement Management (access packages), Terms of Use, and the Entra P1 versus P2 licensing line. Identity governance is distinct from authentication (covered in LO4) and Azure RBAC role design (covered in LO6): governance is the lifecycle and oversight layer that sits on top of whatever identities and roles you already have.
Retrieval target
- Recommend a Solution for Identity Governance
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Privileged Identity Management (PIM) | An Entra ID P2 service for controlling standing admin privilege. Manages Entra directory roles, Azure RBAC roles, and PIM-for-groups memberships. Lets you mark assignments as eligible (activate on demand) instead of always-on, with optional MFA, justification, approval, and time limits. Every activation is logged for audit. |
Access review | A recurring (or one-off) attestation campaign where designated reviewers — managers, group owners, the users themselves, or selected users — confirm whether a user still needs a group membership, app access, or role assignment. Configurable outcome: keep, remove, or auto-remove if not reviewed. Available for groups, apps, Entra roles, Azure roles, and access packages. Requires Entra ID P2. |
Entitlement Management | An Entra ID P2 module that packages groups + apps + sites + role assignments into self-serve access packages, gated by approval workflows and time-bound. Lets a business owner publish 'request access to the Sales tools bundle' instead of IT manually granting each resource. Includes built-in B2B guest onboarding if the request comes from outside the tenant. |
Access package | The unit of self-serve access in Entitlement Management — a bundle of resource roles (group memberships, enterprise-app assignments, SharePoint site roles) plus policies that say who can request it, who must approve, what justification is required, and how long the assignment lasts. Lives inside a catalog. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.