AZ-303 Exam - Question 141

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

A user named Admin1 attempts to create an access review from the Azure Active Directory admin center and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other identity Governance settings are available.

Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles.

You need to ensure that Admin1 can create access reviews in contoso.com.

Solution: You assign the Global administrator role to Admin1.

Does this meet the goal?

Examice · Accepted Answer

Assigning the Global administrator role to Admin1 would ensure that Admin1 can create access reviews. The Global administrator role has the highest level of access in Azure AD and includes permissions to manage all aspects of Azure AD, including access reviews. Since the issue is a permission-related one where Admin1 is unable to access the Access reviews settings despite having other relevant roles, elevating Admin1 to a Global administrator would grant the necessary permissions to create and manage access reviews.

lolo13698 · Answer

It should be NO. The questions says the user is already member of "user administrator" which is a prerequisite for Access Review. So giving the user the global admin role can't be the answer. Something else is needed (maybe the P2 licence)

tmfahim · Answer

should be "Yes"

TSMRE · Answer

On exam 6/7/21, I said yes and passed the exam

Anu2020 · Answer

For Azure AD roles in Privileged Identity Management, only a user who is in the Privileged role administrator or Global administrator role can manage assignments for other administrators. You can grant access to other administrators to manage Privileged Identity Management. Global Administrators, Security Administrators, Global readers, and Security Readers can also view assignments to Azure AD roles in Privileged Identity Management.

jd94 · Answer

6/12/2021. Passed the exam. YES

Thisismynickname001 · Answer

Access Review prerequisites: 
> Azure AD Premium P2
> Global administrator or User administrator
> Microsoft 365 and Security group owner (Preview)
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review#prerequisites

If you are Global Administrator without a license and you try to use Access Review you'll see following error: Tenant does not have a valid license (EMS E5 or P2) required for Access reviews.

spiraltrip · Answer

The question is about creating access reviews, not responding do it. To create access reviews, either you:

1.  Azure AD Premium 2
2.  Global Administrator or User Administrator

You still need to purchase Azure AD Premium 2 for each of the user that requires an access review.

So the answer should be "Yes"

malyaban · Answer

Answer is YES i.e. incorrect first we do not need P2 for creating Access Reviews, even if you provide P2 still the creation needs global admin or privileged role admin. Here Global admin is being given.

https://developer.microsoft.com/en-us/graph/blogs/retrieving-azure-ad-access-reviews/

praveen_617 · Answer

Azure AD Premium P2 licenses are not required for users with the Global Administrator or User Administrator roles who set up access reviews, configure settings, or apply the decisions from the reviews.

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview#how-many-licenses-must-you-have

network_zeal · Answer

Answer is YES, 
as per Microsoft documentation, 
Azure AD Premium P2 licenses are NOT required for users with the Global Administrator or User Administrator roles who set up access reviews, configure settings, or apply the decisions from the reviews.

kumarts · Answer

Answer is Yes, refer https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

azurecert2021 · Answer

Answer should be yes as Azure AD Premium P2 license is not required for Global Administrator or User Administrator roles ,license is only required for User Access Administrator in the Azure AD Privileged Identity Management (PIM) experience
Using this feature requires an Azure AD Premium P2 license.
Azure AD Premium P2 licenses are not required for users with the Global Administrator or User Administrator roles who set up access reviews, configure settings, or apply the decisions from the reviews.
You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management (PIM) experience.
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

user110819801 · Answer

The answer should be Yes. The two previous questions were a No because the tenant still have to be onboarded to access reviews. In this case, the user is given the Global Administrator role, which allows him or her to onboard the tenant to access reviews.

rsaintt · Answer

option A - Yes : https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review

QiangQiang · Answer

It's Yes,
Prerequisites of creating access reviews:
Azure AD Premium P2 (Other IG features are available meaning P2 license exists)
Global administrator or User administrator
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

azurellc · Answer

On exam 5/15/2021

Ario · Answer

Correct answer is Yes - user has Global Admin which is required and also P2 License already there.

topicks · Answer

Azure AD Premium P2 licenses are not required for users with the Global Administrator or User Administrator roles who set up access reviews, configure settings, or apply the decisions from the reviews

akp1000 · Answer

Anser is Yes. https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

crazyaboutazure · Answer

Answer is NO but reason is tenant is onboarded not given which is a requirement. After that if you want to create access review for AD role you need P2 license which is given in question and then you need to have either global or privileged admin role. User admin is suitable for creating access review for app and app group. Period.

syu31svc · Answer

Answer is No

https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

mj4 · Answer

User administrator should have required permission, if not ask him to use access review in  PIM

Answer is B. No for all three questions

mj4 · Answer

going with Yes, If Service admin cant get his access, then we need to give higher permission which is Global admin.

gcpbrig01 · Answer

Being Global administrator still not help as the tenant needs to be onboarded for access first. hence the answer is no.

therealss · Answer

i believe the answer is yes.   another poster mentioned that you already know you have P2 license installed from what you can see on the screen already.   so by adding Global Admin role (plus we inferred P2 license is already present) that should be enough to enable the reviews.

ishin999 · Answer

I think there may be a bit of confusion here....The answer is NO... My understanding of this is that P2 is required at the tenant level...you don't have to allocate a P2 licence to Global admin or User admin to use access review....BUT...you need to allocate any other user a P2 licence out of the licencing pool to allow them to set up access reviews....The fact in this case that the user mentioned has "user admin" already and can't use access reviews indicates that the tenant does not have P2....granting GA will not meet the requirement

AZ-303 Exam - Question 141

Discussion