az-305

Azure Subscription and Application Permissions

• Azure subscription contains a custom application named Application1 developed by Fabrikam, Ltd.
• Developers from Fabrikam have role-based access control (RBAC) permissions for Application1 components.
• All users hold licenses for the Microsoft 365 E5 plan.

Requirements for Permission Verification

• A monthly email must be sent to the manager of the developers listing the access permissions to Application1.
• Access permissions must be automatically revoked if the manager does not verify them.
• The solution should minimize development effort.

Recommended Solutions

• Access Review: Utilize Azure Active Directory (Azure AD) to create an access review specifically for Application1 to meet compliance and auditing needs.
• Azure Automation Runbook:
  • Create a runbook that utilizes the Get-AzRoleAssignment cmdlet to pull current role assignments.
  • Alternatively, use the Get-AzureADUserAppRoleAssignment cmdlet to retrieve app role assignments for users.
• Privileged Identity Management: Implement a custom role assignment in Azure AD Privileged Identity Management for managing access to Application1 resources effectively.

Conclusion

• A combination of Azure AD and automation tools can streamline the process of verifying access permissions and managing RBAC efficiently in Azure environments.

This quiz covers the evaluation of role-based access control (RBAC) permissions for external developers working on a custom application in Azure. It discusses methods for verifying ongoing access needs and compliance with organizational policies, specifically in the context of Microsoft 365 E5 licensing.