Designing Microsoft Azure Infrastructure Solutions

To meet the requirements of verifying whether the Fabrikam developers still need access to Application1 and to minimize development effort, the best solution is to use an access review in Azure Active Directory. An access review allows administrators to send periodic notifications to managers, listing current permissions. If the permissions are not verified, the access can be automatically revoked. This solution is configuration-based and does not require custom development, meeting both the notification and automated revocation requirements efficiently.

Shared Access Signatures (SAS) are the correct solution as they allow for the specification of an expiration date and time, providing controlled and time-limited access to resources in an Azure Storage account. This fits the requirement of enabling access only during the month of April. SAS tokens can be precisely configured to expire at the end of April, automatically revoking access thereafter. Conditional Access policies, certificates, and access keys do not offer this level of granular time-based control specific to Azure Storage resources.

To provide remote users with single sign-on (SSO) access to an on-premises web app that uses Integrated Windows authentication, without VPN access, you should use Azure AD Application Proxy and Azure AD enterprise applications. Azure AD Application Proxy allows you to securely publish the on-premises web app to the internet, enabling remote access without the need for a VPN. Azure AD enterprise applications enable Azure AD to manage the authentication and authorization for the app, providing the necessary SSO capabilities.

An access review in Azure AD is the best solution for evaluating the membership of Group1. It allows setting up periodic evaluations, in this case, every three months, and enables each member to review and report their need for continued membership in the group. Those who do not respond or report that they do not need access can be automatically removed from the group, fulfilling all the specified requirements.