Microsoft Azure Architect Design (AZ-304) Practice Test

Which solution should be recommended to verify whether Fabrikam developers still require permissions to Application1?

1. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

2. Create an Azure Automation runbook that runs the Get-AzureRoleAssignment cmdlet.

3. Use Azure Active Directory access reviews.

4. Implement Azure Policy for permission governance.

The correct answer is: Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.

The recommended solution to verify whether Fabrikam developers still require permissions to Application1 is to use Azure Active Directory access reviews. This feature allows organizations to periodically review user access and assignments to applications, ensuring that users retain only the permissions that are necessary for their current role and job functions. Using access reviews is particularly beneficial as it provides a systematic and organized method to assess the need for ongoing permissions, enabling administrators to take actionable steps based on the review's findings. Moreover, this approach not only enhances security by minimizing excessive permissions but also promotes compliance with internal policies and regulations. While the other options mention automation tasks and commands for querying user and role assignments, they do not offer the same holistic governance and review capabilities that the access reviews feature does. Access reviews are specifically designed for validating ongoing user access against defined criteria, making it an essential tool for effective permission management within Azure Active Directory.