An Azure subscription contains a custom application (Application1) developed by an external company (Fabrikam, Ltd.). Fabrikam developers were granted role-based access to components of Application1. Propose a low-development solution that: (1) sends the developers' manager a monthly email listing access permissions to Application1, and (2) automatically revokes any permission the manager does not confirm. Which should you recommend?

Creating an access review in Azure AD is the correct solution because it directly addresses both requirements with minimal development. Access reviews allow you to regularly review user access to resources, including applications. You can configure them to send notifications (like monthly emails to a manager) and automatically revoke access for unconfirmed permissions. An Azure Automation runbook running Get-AzRoleAssignment would list permissions but wouldn't automatically handle the manager's confirmation or revocation, requiring significant custom development. Similarly, Get-AzureADUserAppRoleAssignment would list application role assignments but lacks the built-in review and revocation workflow. Creating a custom role assignment in Privileged Identity Management (PIM) is about defining new roles or elevating existing ones, not about reviewing and revoking existing access based on a manager's confirmation.