An organisation publishes an access package that bundles internal HR systems and must be requestable by employees, but must never be discoverable or requestable by guest or external users brought in from connected organisations. Which assignment policy configuration on the access package enforces this?
- AConfigure the assignment policy so that only users in the directory, scoped to specific internal groups, can request the package, leaving the For users not in your directory option disabled. Correct
- BSet the policy so that external users from connected organisations can request access, then add a manual approval step that the resource owner uses to reject every guest request.
- CCreate a separate catalog marked as internal and move the access package into it, because catalog visibility settings stop guests from requesting any package it contains.
- DEnable the policy for all users in your directory and rely on a Conditional Access policy that blocks guest accounts from reaching the entitlement management request portal.
Why A is correct: The requestor scope on an assignment policy decides who may request a package, and limiting it to internal directory users while not enabling external requestors prevents guests from discovering or requesting it.
Why B is wrong: Allowing external users to request still makes the package discoverable to them and relies on a manual rejection each time, which is error-prone and does not prevent guests from requesting in the first place.
Why C is wrong: Catalog enablement controls whether packages can be published, not who may request a published package; the per-policy requestor scope, not the catalog, determines guest eligibility.
Why D is wrong: All users in your directory still includes existing guest accounts, and Conditional Access governs sign-in access rather than per-package requestor eligibility, so guests could still request the package.