Nordlicht Reisen GmbH, a fictional travel agency, must show the external audit this quarter that its booking data doesn't leave the EU, that departed employees no longer have access and that partner access doesn't last forever. Two questions stand behind this: how do you prove that Azure is set up as the rules demand (compliance), and how do you make sure that the right people have the right access at the right time (identity governance)? The exam calls this: recommend a solution for managing compliance and recommend a solution for identity governance.
Prior knowledge. What Azure Policy, Defender for Cloud and the compliance area are is covered in "AZ-900 compact", lesson 3.2. How to assign a policy and enforce a region is shown in AZ-104, lesson 1.5; guests and external users are covered in AZ-104, lesson 1.2. How sign-in and access to resources are designed is covered in lessons 1.2 and 1.3 of this course; the structure of management groups from lesson 1.5 is not repeated, it is the place here where policies hang. What is new is the decision: which tool answers which question of the audit and what it costs.
The requirement
The sheet of Nordlicht Reisen for this lesson (all numbers are assumptions of the task):
| Requirement | Source | Measure (assumption) |
|---|---|---|
| Data only in the EU | Data protection | creating resources outside two EU regions is not possible |
| Proof of the configuration to the audit | Management, contracts with hotel chains | one report per quarter against a security benchmark (for example ISO 27001) |
| Departed employees lose access | IT management | at the latest on the next working day |
| Partner access expires | Security | about 400 external users, renewal only on request of a responsible person at the partner company |
| Administrator permissions only when needed | Security | at most four people with permissions in the platform, time window instead of standing permission |
| All 220 employees have Microsoft Entra ID P1 | License status | assumption of the task |