5.1.2. Access Requests, Terms of Use, and External User Lifecycle
💡 First Principle: The request pipeline is where governance meets users — and where external access finally gets a lifecycle. A guest who arrives through a package is born with an expiration date and a cleanup rule, which is precisely what ad-hoc B2B invitations from Phase 3 lacked.
The request flow end to end:
Requests happen in the My Access portal (myaccess.microsoft.com); approvers act there or from email. Terms of use (ToU) — PDF agreements presented for acceptance — attach via Conditional Access broadly (2.2.1's grant control) or per-package here; acceptance is logged and reportable (who accepted which version when), re-acceptance can recur on a schedule, and per-device acceptance is available. Compliance stems ("contractors must accept the NDA before accessing the project site") land on ToU attached to the package or a CA policy targeting the resources.
Connected organizations make external request policies manageable: register a partner (by their tenant domain or IdP), then scope package policies to "specific connected organizations" — their users request without pre-invitation, and B2B guest objects are created on approval. The external user lifecycle settings close the loop: when an external user's last package assignment expires, entitlement management can automatically block sign-in and then delete the guest account after a configured number of days — the answer to "guests must be removed automatically when project access ends."
⚠️ Exam Trap: The auto-delete lever governs guests brought in through entitlement management; guests invited manually in Phase 3 fashion aren't lifecycle-managed by it (they need access reviews of guest access, 5.2, or inactive-guest cleanup). "Automatically delete partner accounts when access expires" presumes the package pathway.
Reflection Question: A partner firm's analysts should request "Falcon Analytics" access themselves, get their manager's approval on your side, accept an NDA, and vanish from your tenant 30 days after access ends. Map each clause to the exact feature configuring it.
