How to Verify and Revoke Fabrikam Developer Access to Application1?
You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan. You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements: ✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1. ✑ If the manager does not verify an access permission, automatically revoke that permission. ✑ Minimize development effort. What should you recommend?
Community Insight
The question tests recognition that Azure AD access reviews combine recurring reviewer notification with automatic removal of unconfirmed access, so the trap is choosing a reporting-only or query-based automation solution instead of the native governance feature.
Azure AD access reviews are the built-in identity governance feature that periodically asks a reviewer such as the Fabrikam developers' manager to confirm whether Application1 role assignments are still needed. This page explains why an access review of Application1 satisfies the monthly email, auto-revocation, and minimal-effort requirements better than custom runbooks or PIM custom roles.
Many candidates pick the Azure Automation runbook options (B or D) because they want to 'list permissions' and assume scripting minimizes effort; however, a runbook only reads assignments, does not send reviewer workflows, and cannot automatically revoke unverified access without significant custom code.
Community Discussion (34 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure AD access reviews are purpose-built for exactly this scenario: an administrator creates a review of the Application1 role assignments (or of the group backing them), selects the managers as reviewers, sets a monthly recurrence, and configures the review to auto-apply results. Reviewers receive email notifications listing the permissions they must verify, and any permission that is not approved within the review period is removed automatically, which matches both stated requirements. Because it is a configuration-based identity governance feature, it also satisfies the 'minimize development effort' constraint without writing, hosting, or maintaining automation code. The Fabrikam developers and their manager are Microsoft 365 E5-licensed users, and access reviews are available with the required Azure AD/Entra ID governance licensing, so no extra platform is needed.Why the Other Options Are Wrong
Option B uses an Azure Automation runbook calling Get-AzRoleAssignment, which only retrieves role assignments; it does not provide a reviewer experience, a monthly email to the manager, or an automatic revoke path, so it would require custom engineering to satisfy the requirements. Option D has the same fundamental flaw with Get-AzureADUserAppRoleAssignment — it is a query cmdlet, not a governance workflow, and it cannot decide or enforce whether access should continue. Option C creates a custom PIM role assignment for the Application1 resources, which addresses just-in-time privileged activation rather than periodic manager attestation, and does not generate the monthly review email or auto-revoke unverified permissions. Only an access review delivers attestation and automatic remediation out of the box.Community Comment Notes
Most learners align on the same answer: NotMeAnyWay explains that 'Access reviews can be scheduled to run on a regular basis' and can notify reviewers, while stonwall12 describes it as configuration-based periodic notification plus auto-revocation. asandas2008 simply confirms 'yes, answer is A,' and r50496a, hamid28, Guru96, and AKYK all post that A is correct. tabkar adds a useful exam-taking caution that 'almost every question was unique and NOT from this dump,' reinforcing that candidates should understand the governance concept rather than memorize this item, and Forsyth observes that 'I see all the comments are 2-3 years old,' a reminder that the service may be branded as Microsoft Entra ID Governance today even though AZ-305 still tests the same capability.Official Reference
Exam Strategy
When a question pairs recurring reviewer notification with automatic removal of unconfirmed access, reach for Azure AD access reviews first; Microsoft positions them as the low-code governance control for entitlement attestation. If an option is a cmdlet or runbook that only reads assignments, it cannot satisfy the auto-revoke clause and should be eliminated.
Frequently Asked Questions
Why is an Azure Automation runbook running Get-AzRoleAssignment wrong here?
It only reads role assignments; it does not email the manager a review task or automatically revoke permissions that the manager fails to approve, so it would require heavy custom development.
Can an Azure AD access review automatically revoke access when the manager does not respond?
Yes. When the review is configured to auto-apply results, any permission the reviewer does not approve within the review period is removed automatically.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →