Design solutions for securing privileged access

Ivory Coast Airlines administers an Azure tenant, an AWS Organization, a GCP organization, and Salesforce. Each platform's administrators currently sign in with platform-local administrator accounts and that platform's own MFA. The CISO wants a single administrative identity per person for all four platforms, phishing-resistant MFA enforced consistently, administration allowed only from compliant privileged devices, and the ability to revoke a departing administrator's access to all platforms in one action. You must minimize ongoing administrative effort.

What should you recommend?

1. AKeep the platform-local administrator accounts and enable each platform's strongest native MFA optionFour separate credential sets cannot be governed by one policy or revoked in one action, and native MFA options differ in phishing resistance across the platforms.
2. BFederate AWS IAM Identity Center, Google Cloud, and Salesforce to Microsoft Entra ID as enterprise applications, and apply a Conditional Access policy to those apps and to Microsoft Azure Management that requires the Phishing-resistant MFA authentication strength and a compliant deviceFederating every platform's administrative sign-in to Microsoft Entra ID makes one identity, one Conditional Access policy, and one offboarding action govern all four; authentication strength and device compliance conditions apply uniformly at the identity provider.
3. CEnable Microsoft Defender for Cloud Apps session policies for Salesforce and AWS console sessionsSession policies can monitor and restrict actions inside a federated SaaS session, but they depend on federation already being in place and do not themselves enforce phishing-resistant MFA or unify the identities.
4. DCreate a separate Microsoft Entra tenant for administrators and invite the production tenant as a B2B partnerA second tenant adds administrative overhead and still leaves AWS, GCP, and Salesforce outside Microsoft Entra governance unless they are federated, which is the actual solution.

Redfern Consulting runs dozens of client projects. Each project needs a bundle of access: a Microsoft 365 group, a SharePoint site, and a line-of-business app role. Project managers, not IT, should approve who joins a project, consultants should be able to request access themselves, and access should expire automatically after 90 days unless renewed. Guest consultants from partner firms must be able to request access too. You must minimize IT administrative effort.

What should you recommend?

1. ACreate an access package per project in Microsoft Entra entitlement management with the project manager as approver, a 90-day expiration policy, and a policy that allows requests from connected organizationsEntitlement management bundles groups, sites, and app roles into an access package with self-service requests, delegated business approval, automatic expiration, and policies for external users from connected organizations, removing IT from each decision.
2. BMake each project group a PIM for Groups role-assignable group with the project manager as approverPIM for Groups provides time-bound activation of group membership for privileged scenarios; it does not bundle SharePoint sites and app roles, and it is not designed for 90-day project membership or external requesters.
3. CCreate dynamic groups whose membership rule matches a project attribute that HR sets on each userDynamic membership depends on attribute updates by HR or IT, offers no approval or self-service, and does not expire access or support partner guests who lack the attribute.
4. DHave IT add consultants to the groups manually after receiving an email from the project managerA manual process is exactly the IT effort the scenario asks to eliminate and gives no automatic expiration or audit trail of approvals.

Oakhurst Media has 300 Microsoft 365 groups that contain partner guest users. Internal audit requires that guest membership in each group be reviewed every quarter by the group's own owners, that guests whose access is denied or who receive no decision be removed automatically, and that IT not have to launch or process the reviews manually.

What should you recommend?

1. ACreate a recurring quarterly access review in Microsoft Entra ID Governance scoped to guest users in all Microsoft 365 groups, with group owners as reviewers and auto-apply results that remove users who are denied or not reviewedAccess reviews support recurring schedules, review scope limited to guests, delegation to group owners, and automatic application of results, including removing users for whom no decision was recorded, which satisfies every requirement without IT intervention.
2. BMake the groups eligible in Privileged Identity Management and require quarterly activation by the guestsPIM for Groups is intended for just-in-time activation of privileged group membership; it is not a review of whether guests should remain, and it burdens guests rather than owners.
3. CConvert the groups to dynamic membership that excludes any guest whose last sign-in is older than 90 daysDynamic membership rules cannot evaluate sign-in activity, and inactivity is not the same as an owner's attestation that access is still appropriate.
4. DExport the group membership to a spreadsheet each quarter and email it to the owners for confirmationA manual export gives no enforcement of decisions, no automatic removal, and requires IT to run and process each cycle, which the audit requirement rules out.

Pembrook Analytics runs workloads across Azure, AWS, and GCP with roughly 6,000 human and workload identities. A review found many identities with broad roles that have not been used for months, and the company wants to continuously discover unused and excessive permissions across all three clouds, see the risk ranked, and receive right-sizing recommendations in the same portal used for cloud security posture. The design must be a Microsoft capability that is generally available and not retired.

What should you recommend?

1. AEnable the Defender CSPM plan in Microsoft Defender for Cloud on the Azure subscriptions and the AWS and GCP connectors, and use its cloud infrastructure entitlement management recommendations for over-privileged and unused identitiesDefender CSPM includes CIEM capabilities that analyze permission usage for Microsoft Entra ID, AWS IAM, and Google Cloud IAM identities, surface over-privileged and inactive identities as recommendations in Defender for Cloud, and are Microsoft's forward direction for entitlement management.
2. BOnboard the three clouds to Microsoft Entra Permissions Management and review the Permission Creep IndexPermissions Management delivered CIEM across clouds, but Microsoft stopped selling it on April 1, 2025 and retired it on November 1, 2025, steering customers to the CIEM capabilities in Microsoft Defender for Cloud; it cannot be chosen for a new design.
3. CAssign an Azure Policy initiative that audits role assignments with the Owner role at subscription scopeAzure Policy can audit Azure role assignments but has no view of AWS or GCP permissions and no notion of permission usage over time.
4. DConvert all Azure role assignments to eligible assignments in Privileged Identity ManagementPIM makes Azure role activation just-in-time but does not discover unused permissions or cover AWS and GCP; it is a complementary control, not a CIEM solution.