How to Verify and Revoke Fabrikam Developer Access to Application1?

AZ-305 By islever Editorial Last updated

Design authentication and authorization solutions Design governance

Short answer

A Configure an Azure AD access review of Application1 so managers get monthly reviewer emails and unverified permissions are revoked automatically.

Question

You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam,
Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the
Microsoft 365 E5 plan.
You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following
requirements:
✑ To the manager of the developers, send a monthly email message that lists the access permissions to Application1.
✑ If the manager does not verify an access permission, automatically revoke that permission.
✑ Minimize development effort.
What should you recommend?
  1. In Azure Active Directory (Azure AD), create an access review of Application1. Correct Answer
  2. Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
  3. In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
  4. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

Key Takeaways

The question tests recognition that Azure AD access reviews combine recurring reviewer notification with automatic removal of unconfirmed access, so the trap is choosing a reporting-only or query-based automation solution instead of the native governance feature.

Azure AD access reviews are the built-in identity governance feature that periodically asks a reviewer such as the Fabrikam developers' manager to confirm whether Application1 role assignments are still needed. This page explains why an access review of Application1 satisfies the monthly email, auto-revocation, and minimal-effort requirements better than custom runbooks or PIM custom roles.

Common mistake: Many candidates pick the Azure Automation runbook options (B or D) because they want to 'list permissions' and assume scripting minimizes effort; however, a runbook only reads assignments, does not send reviewer workflows, and cannot automatically revoke unverified access without significant custom code.

Expert Analysis

Why the Answer Is Correct

Azure AD access reviews are purpose-built for exactly this scenario: an administrator creates a review of the Application1 role assignments (or of the group backing them), selects the managers as reviewers, sets a monthly recurrence, and configures the review to auto-apply results. Reviewers receive email notifications listing the permissions they must verify, and any permission that is not approved within the review period is removed automatically, which matches both stated requirements. Because it is a configuration-based identity governance feature, it also satisfies the 'minimize development effort' constraint without writing, hosting, or maintaining automation code. The Fabrikam developers and their manager are Microsoft 365 E5-licensed users, and access reviews are available with the required Azure AD/Entra ID governance licensing, so no extra platform is needed.

Why the Other Options Are Wrong

Option B uses an Azure Automation runbook calling Get-AzRoleAssignment, which only retrieves role assignments; it does not provide a reviewer experience, a monthly email to the manager, or an automatic revoke path, so it would require custom engineering to satisfy the requirements. Option D has the same fundamental flaw with Get-AzureADUserAppRoleAssignment — it is a query cmdlet, not a governance workflow, and it cannot decide or enforce whether access should continue. Option C creates a custom PIM role assignment for the Application1 resources, which addresses just-in-time privileged activation rather than periodic manager attestation, and does not generate the monthly review email or auto-revoke unverified permissions. Only an access review delivers attestation and automatic remediation out of the box.

Community Comment Notes

Most learners align on the same answer: NotMeAnyWay explains that 'Access reviews can be scheduled to run on a regular basis' and can notify reviewers, while stonwall12 describes it as configuration-based periodic notification plus auto-revocation. asandas2008 simply confirms 'yes, answer is A,' and r50496a, hamid28, Guru96, and AKYK all post that A is correct. tabkar adds a useful exam-taking caution that 'almost every question was unique and NOT from this dump,' reinforcing that candidates should understand the governance concept rather than memorize this item, and Forsyth observes that 'I see all the comments are 2-3 years old,' a reminder that the service may be branded as Microsoft Entra ID Governance today even though AZ-305 still tests the same capability.

Official Reference

https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question pairs recurring reviewer notification with automatic removal of unconfirmed access, reach for Azure AD access reviews first; Microsoft positions them as the low-code governance control for entitlement attestation. If an option is a cmdlet or runbook that only reads assignments, it cannot satisfy the auto-revoke clause and should be eliminated.

Frequently Asked Questions

Why is an Azure Automation runbook running Get-AzRoleAssignment wrong here?

It only reads role assignments; it does not email the manager a review task or automatically revoke permissions that the manager fails to approve, so it would require heavy custom development.

Can an Azure AD access review automatically revoke access when the manager does not respond?

Yes. When the review is configured to auto-apply results, any permission the reviewer does not approve within the review period is removed automatically.

More AZ-305 FAQ →

Discussion 27 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 27

  1. NotMeAnyWay 👍 22 Answered A
    Here's why: An access review is a feature in Azure AD that enables an administrator to review the membership of a group or application role to ensure that only the right people have continued access. This aligns with the requirement to verify access permissions to Application1. Access reviews can be scheduled to run on a regular basis and can be configured to send email notifications to reviewers. This satisfies the requirement to send a monthly email message to the manager of the developers listing the access permissions to Application1. Access reviews also provide the option to automatically revoke access if the reviewer does not verify an access permission, which fulfills the requirement to automatically revoke permissions if the manager does not verify them. Implementing an access review in Azure AD requires minimal development effort and can be set up through the Azure portal with a few simple clicks.
  2. stonwall12 👍 7
    Correct Answer - A: Access Review An access review in an Azure AD feature that allows an admin to evaluate and verify user access to certain roles and resources. Based on the question's requirements, with an Access Review, we can configure periodic notifications about permissions and enable auto-revocation of access, all through a configuration-based approach. https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
  3. andas2008 👍 4
    yes, answer is A
  4. tabkar 👍 3 Answered A
    A is correct. I appeared and passed in AZ-305 exam today and almost every question was unique and NOT from this dump. So please study and learn very well conceptually otherwise, you will be shocked!
  5. hamid28 👍 3 Answered A
    correct answer
Show 22 more comments
  1. Forsyth 👍 2 Answered A
    Anyone used this questions lately in the exam? I see all the comments are 2-3 years old.
  2. Guru96 👍 2 Answered A
    Correct
  3. Bewran 👍 1 Answered A
    Access Reviews in Microsoft Entra ID Governance help ensure the right people have the right access to the right resources. They regularly review access to apps, groups, and sensitive data, helping reduce unnecessary access, improve security and compliance, and remove access when it is no longer needed.
  4. AlfKay 👍 1
    i found the same,all the comments are ages and not recent,i just wonder....which question is updated.
  5. flash007 👍 1
    Access reviews can be sent out to ask the user if they still need access to the file/area drive etc
  6. ragavan667 👍 1 Answered A
    A. In Azure Active Directory (Azure AD), create an access review of Application1.
  7. 045b109 👍 1 Answered A
    Access review is the correct answer
  8. Gor 👍 1
    Correct A. Azure AD Access Review
  9. Ficus22 👍 1 Answered A
    Correct answer - A. Access review
  10. scottishstvao 👍 1 Answered A
    Correct, the answer is A
  11. janvandermerwer 👍 1 Answered A
    A makes the most sense.
  12. daddy78 👍 1 Answered A
    Access review it is
  13. jj22222 👍 1 Answered A
    a because its right
  14. yonie 👍 1 Answered A
    Correct answer - A
  15. OPT_001122 👍 1 Answered A
    A. Access review
  16. Sasanka 👍 1 Answered A
    This is correct
  17. Born_Again 👍 1 Answered A
    Access Review
  18. recursosbd 👍 1
    A, is correct
  19. Batner 👍 1 Answered A
    A is correct
  20. Bummer_boy 👍 1 Answered A
    A. no doubts
  21. jj22222 👍 1
    A is right
  22. dodoyop 👍 1 Answered A
    Answer A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Storage setup retains blobs immutably for five years?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide