5.5. Reflection Checkpoint

Key Takeaways

• Entitlement management productizes access: catalogs bound what delegated owners may package; packages carry policies (requestors, approvals, ToU, expiration, embedded reviews); connected organizations let partners self-request; and external-user lifecycle blocks-then-deletes guests when their last assignment expires.
• Access reviews only govern when results apply: choose scope (guests, apps, roles first), reviewer (self/manager/owner), no-response behavior, and auto-apply — recommendations and inactivity flags make large reviews honest instead of rubber-stamped.
• PIM makes privilege temporal: eligible ≠ active; per-role/per-group settings gate activation (MFA or auth context, justification, ticket, approval, duration); PIM for Azure resources and for Groups extend the machinery to RBAC and to anything a group grants; alerts and audit history keep the system honest.
• Break-glass accounts invert every rule on purpose — cloud-only, permanently active GA, CA-excluded, vault-stored phishing-resistant credentials, sign-in-alerted — because they exist for the day the controls themselves fail.
• Monitoring = right log (sign-in / audit / provisioning) → right destination (Log Analytics to query and alert, storage to archive, Event Hub to stream) → right tool (KQL, workbooks, Secure Score for posture).

Connecting Forward

Phase 6 shifts from learning to scoring: exam strategy for Microsoft's scenario formats, the quick-reference tables that compress these five phases into revision material, and mixed-domain practice questions in exam voice.

Self-Check Questions

• A regulator requires: contractors request access with manager approval and NDA acceptance, all access recertified quarterly by resource owners with automatic removal, and privileged roles activated (never standing) with two-hour windows and named approvers. Name the three feature families and one configuration detail each that satisfies the requirement.
• The SOC reports the break-glass account signed in at 02:14. List, in order, the artifacts you'd consult to reconstruct what happened — naming the log or PIM surface each fact comes from.
• Your quarterly guest review keeps "completing" while stale guests linger. Name the three settings you'd check, in order of likelihood, and the entitlement-management design that would have made most of those guests self-expiring.