What role does an IAM policy play in federated identity access?

Question breakdown

Tests

Configure authorization for federated identities in OCI

Difficulty

Easy

Key idea: Federation authenticates users externally, while OCI IAM policies grant permissions to the OCI groups those external groups are mapped to.

How to reach the answer

1. Separate authentication (handled by the external IdP via federation) from authorization (handled by OCI policies).
2. Group mapping links IdP groups to OCI groups.
3. Policies are written against groups ('Allow group X to ...'), so they grant federated users their permissions.
4. Options about federation rules, networking or database availability describe other mechanisms.

Each option

• AIncorrect. Federation trust and group mappings are configured on the identity provider/domain, not in IAM policies.
• BCorrect. Policies define what the mapped federated groups may do on which resources and compartments.
• CIncorrect. Network access is controlled by security lists, NSGs and routing, not IAM policies.
• DIncorrect. Database availability is an HA architecture concern, unrelated to IAM policies.

Common trap: Option A appeals because policies and federation are both IAM features, but policies only authorize; they do not define the federation trust.

In practice: When integrating Microsoft Entra ID with OCI for Database@Azure, you map Entra groups to OCI groups and write policies granting them database management rights.

Remember: IdP authenticates; OCI policies on mapped groups authorize.

Official documentation: How Policies Work

Drafted with AI assistance and checked against the answer key.