A governance architect must design an access review that covers users with eligible and active assignments to the Global Administrator role and ensures the review repeats every three months. The review must target the privileged role assignments specifically rather than a group or application. Which review resource type should the architect select?
- ACreate the access review on a security group that contains the role members, then set the recurrence to quarterly so the role assignments are reviewed indirectly through the group.
- BCreate an access review for the Microsoft Entra role in Privileged Identity Management, scoped to Global Administrator with a quarterly recurrence covering eligible and active assignments. Correct
- CCreate the access review on the enterprise application that represents the directory, then schedule it quarterly to capture everyone who holds the Global Administrator role.
- DCreate an access package in entitlement management for the Global Administrator role, then attach a quarterly access review to that package to cover the role holders.
Why A is wrong: Reviewing a security group reviews group membership, not the role assignments themselves, and the membership may not match who actually holds the role, so it does not directly target the privileged role.
Why B is correct: Access reviews for Microsoft Entra roles are created in Privileged Identity Management, target the role directly, include eligible and active assignments, and support a quarterly recurrence, matching every requirement.
Why C is wrong: An enterprise application review covers that application's assignments, not Microsoft Entra directory role membership, so it would not enumerate eligible and active Global Administrator holders as required.
Why D is wrong: Entitlement management governs access packages for resources rather than directory role assignments, so an access package cannot enumerate eligible and active Global Administrator assignments for review.