How can you enforce role-based access control across multiple apps?

• A. Disable provisioning to all apps.
• B. Define roles in a central identity provider and propagate roles to connected apps via SCIM or provisioning connectors.
• C. Use password-based access control across all apps.
• D. Create identical roles separately in each app.

Answer: (B)

Centralizing role definitions in a single identity provider and distributing them to connected apps via SCIM or provisioning connectors is the effective way to enforce role-based access control across multiple applications. This approach keeps role membership and permissions in one place, ensuring consistency across all apps, simplifies onboarding and offboarding, and reduces the administrative burden of updating access in every app separately. It relies on standard provisioning protocols so each connected application stays in sync as roles and users change.

Disabling provisioning stops automatic synchronization, leaving apps out of sync. Relying on passwords for access control doesn’t manage permissions at the application level. Creating identical roles in each app leads to drift and ongoing maintenance when roles evolve.