AZ-303 Exam - Question 77

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

A user named Admin1 attempts to create an access review from the Azure Active Directory admin center and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other Identity Governance settings are available.

Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles.

You need to ensure that Admin1 can create access reviews in contoso.com.

Solution: You assign the Service administrator role to Admin1.

Does this meet the goal?

Examice · Accepted Answer

Admin1 needs specific roles to create access reviews in Azure AD, such as the Global administrator or User administrator role. Admin1 already has the User administrator role, which should be sufficient. However, the Service administrator role is not related to Identity Governance settings, so assigning it would not solve the issue of creating access reviews. Additionally, Admin1 may need an Azure AD Premium P2 license to access and create access reviews, which is not addressed by assigning the Service administrator role.

JasonYin · Answer

Answer should be No. Test in lab, must have one P2 license at least. Then both Global admin and User Administrator Role will be able to do. Admin1 already has User Administrators Role, no need Global Admin role.

ercank · Answer

Definitely YES. I tested it. Global Administrator role make it possible.

pentium75 · Answer

https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

"Prerequisites: Azure AD Premium P2, Global administrator or User administrator, Microsoft 365 and Security group owner (Preview)"

Per this, User Administrator should have the permission. If it still is not there, then it's probably due lack of P2.

In any case, "Service Administrator" has nothing to do with it, so the answer to THIS specific question ('does assigning Service Administrator fix the issue') is definitely NO.

syu31svc · Answer

Answer is No

https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

Prerequisites
Azure AD Premium P2
Global administrator or User administrator
Microsoft 365 and Security group owner (Preview)

jh5280 · Answer

So to me, based on this URL: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#license-requirements

Seems that once you assign the global administrator role, you don't need the P2 license, therefor, base on the above question it should satisfy the need as Admin1 has the Global Administrator role, is this not correct?

ManuPadipura · Answer

Anyone know what is the correct answer?

Aand1234 · Answer

No, as it doesn't have P2 license. It requires both P2 license and Role

leahchawas · Answer

For access reviews to be possible ,a Tenant needs an Az AD Premium P2 licence to be assigned to the tenant 1st.If this licence is assigned User Administration role should suffice to achieve access reviews.In this case there is no Premium P2 licence assigned to the tenant and so i think NO is the correct answer here ...

Guilherme · Answer

I think the correct answer would be "Onboard the Tenant to allow for access reviews", because he is already a user administrator and already have an Azure P2 Licence (all the other identity Governance settings are available)

jd94 · Answer

6/12/2021. Passed the exam. NO

nfett · Answer

A is the answer per https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

El_Hechizo · Answer

according to Create an access review of groups & applications - Azure AD | Microsoft Docs user administrator can create access reviews if admin1 can't do it should be because they don't have the P2 Licence. Therefore answer is NO

Nands23 · Answer

This was on today's exam.  12/29/2021
correct answer

JayBee65 · Answer

So what we are saying here is that the Admin has the rights they required but AAD does not support it since "Access reviews settings are unavailable", and so a P2 license must not be available, so assigning extra permissions won't help anything.

AZ-303 Exam - Question 77

Discussion