Cabin check-in: Ensure least privilege access

Thanks for joining today’s session! Below is an overview of topics and questions our panelists covered during this session, as well as associated timestamps: 

Overview of the Microsoft Entra Suite & Demo started at 1:24. 

 

Live Q&A with Product experts at 19:11.

 

Question – For all these ID governance features we looked at, are these only available for employees or can guests and external users use these as well? - answered at 20:42. 

• To learn more go to aka.ms/EntraIDGuestGovernance

 

Question – How does Entra Suite handle lifecycle workflows when a user’s attributes (like department or manager) are updated via HR-driven provisioning? - answered at 22:19. 

 

Question – How can I map employee attributes to dynamic group memberships? - answered at 25:19. 

 

Question – Will the decks from this session be available for everyone? - answered at 26:17. 

 

Question – Can I only grant access to M365 apps? - answered at 26:34. 

 

Question – So, if we’re trying to enforce least privilege across our org—what are the most common mistakes we should avoid? - answered at 27:32.

 

Question – How many people can be notified about access prompts? - answered at 29:53. 

 

Question – How can Entra help us prep for compliance audits? - answered at 31:53. 

 

Question – How does Group SOA impact the management of legacy security groups that were previously synchronized from Active Directory? Are there any limitations or caveats to be aware of when flipping the source of authority? - answered at 33:39. 

 

Question – Follow up question – Can we clarify how licensing works with Group SOA? Is it part of ID governance? Is it part of the suite? - answered at 38:03. 

 

Question – How can I grant access just for a specific person via Microsoft Entra ID? - answered at 39:16. 

 

Question –  How do we manage user provisioning to mainframe (RACF etc), since it’s a legacy system, I’m quite curious to see that we had a group called mainframe during the demo, as far as I know this is normally handled by disconnected (delimited file) connector to manage authorization and user creation, so how can we tie an LDAP/AD groups to RACF (group profile)? - answered at 42:42. 

 

Question – What is the difference between Face Check with Verified ID vs. auth methods like MFA? - answered at 45:53. 

 

Question – Is Face Check just used for unlocking a device, or can it be used for specific apps? - answered at 47:45. 

 

Question – You mentioned compliance and audits earlier, any Copilot or AI capabilities to help here? - answered at 50:09. 

 

Question – Advice for organizations looking to integrate Microsoft Entra suite, specifically ID governance capabilities, into their existing infrastructure? - answered at 52:15.