AZ-300 Exam - Question 214

Question

Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

A user named Admin1 attempts to create an access review from the Azure Active Directory admin center and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other Identity Governance settings are available.

Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles.

You need to ensure that the Admin1 can create access reviews in contoso.com.

Solution: You assign the Global administrator role to Admin1.

Does this meet the goal?

Examice · Accepted Answer

Assigning the Global administrator role to Admin1 will ensure that they can create access reviews. Global administrators have full access to all management features in Azure Active Directory, including the ability to create and manage access reviews. Therefore, this meets the goal of enabling Admin1 to create access reviews in the Azure AD tenant.

SaurabhAzure · Answer

the answer should be yes.
As because global administrators can perform access review. We do not need P2 license for global administrators

gboyega · Answer

A is the correct Answer

No licenses are required for the users with the Global Administrator or User Administrator roles that set up access reviews, configure settings, or apply the decisions from the reviews.

cttay71 · Answer

Scenario 1: i tried creating admin1 with Global Administrator role or User Administrator role only and I am not able to create Access Review.

Scenario 2: I create admin with User Admin role with Azure AD Premium P2 licenses enabled.  I am able to create Access Review.  Therefore, Azure AD Premium P2 is required whether you are global administrator or user administrator.  Since questions already mentioned admin1 has User Administrator role, he should be able to create access review.  But he could not.  
So my answer is NO
My Answer is NO.

Jer0i · Answer

Answer is B

https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-give-access-to-pim

The Global administrator who enables Privileged Identity Management (PIM) for an organization automatically get role assignments and access to Privileged Identity Management. No one else in your Azure Active Directory (Azure AD) organization gets write access by default, though, including other Global administrators. Other Global administrators, Security administrators, and Security readers have read-only access to Privileged Identity Management. To grant access to Privileged Identity Management, the first user can assign others to the Privileged Role Administrator role.

It says "...No one else in your Azure Active Directory (Azure AD) organization gets write access by default, though, including other Global administrators."

So even though you assign Admin1 as the GA, he still will not have access to PIM

turtle666 · Answer

Azure AD Premium P2 licenses are not required for the following tasks:

No licenses are required for the users with the Global Administrator or User Administrator roles that set up access reviews, configure settings, or apply the decisions from the reviews.

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

BalaMurugesan · Answer

YES - "Programs and access review results are visible to users in the Global administrator, User administrator, Security administrator, or Security reader role."

https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

Prash85 · Answer

This question doesn't talk about licenses instead it is focused on the roles and its privileges...   Global Admin can create access review..  answer is YES

[Removed] · Answer

Creating access review on a group that can be assigned to Azure AD role
If you are on the newest version of Access Reviews (your reviewers are directed to My Access by default) , then only Global Administrator can create access review on role-assignable groups. However, if you are on older version of Access Reviews (your reviewers are directed to the Access Panel by default), then both Global Administrator and User Administrator can create access review on role-assignable groups.

BEB · Answer

Answer is NO. 
Privileged Role Administrator is required to Create an access review. see https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review
"You can use Azure AD Privileged Identity Management (PIM) to create access reviews for privileged Azure AD roles. You can also configure recurring access reviews that occur automatically."
"Prerequisites
Privileged Role Administrator"

Bluediamond · Answer

https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

Pigi_102 · Answer

From: https://azure.microsoft.com/en-us/pricing/details/active-directory/ 
Premium P2 is the only license with Access Review Option.
Moreover, from https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview , License Requirement:
"Using this feature requires an Azure AD Premium P2 license." 
So the answer is NO.

thirstylion · Answer

Answer is A (Yes)
No licenses are required for the users with the Global Administrator or User Administrator roles that set up access reviews, configure settings, or apply the decisions from the reviews.

addy007 · Answer

Ans: B, https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review

arseyam · Answer

When you enable Access Reviews for the first time, you have to click on Onboard Now, which enables access reviews for the Azure AD directory.  Note that if you don’t complete this step, the Overview page of access reviews will report an error Tenant is not onboarded for Access Reviews feature.
Below is a great article to clear the confusion
https://campbell.scot/getting-started-with-azure-ad-identity-governance-part-2-access-reviews/

basak · Answer

to access review rules the user should have PIM license. So B is correct
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

deyc · Answer

1- Create an access review of groups and applications in Azure AD access reviews
Prerequisites
Azure AD Premium P2
Global administrator or User administrator

2- Create an access review of Azure AD roles in Privileged Identity Management
Pre-requisite:
Privileged Role Administrator

If I read the question correctly, the access is for groups and apps and not for AD roles...

If this is the case, the answer is NO because PIMS P2 is also required

AZ-300 Exam - Question 214

Discussion