Each of the organization's 40 business applications maintains its own user store, and departing employees often keep accounts in some applications for months. Which architectural change would BEST address this problem?
Select an answer to reveal the explanation.
Short Explanation
Forty separate guest lists means forty chances for you to forget to cross someone off. One central list, checked by every door, means one removal locks them out everywhere. The trap is a periodic review: it helps, but it's not an architectural fix and it leaves you exposed for months.
Full Explanation
When identity is centralized, applications delegate authentication to an enterprise directory or identity provider, which becomes the control plane for access. A single disable action at departure removes access across every connected application at once, and consistent policies such as multifactor authentication and account lifecycle rules apply uniformly. This addresses the root cause, which is fragmentation across 40 independent user stores. An annual review by each application owner is a detective process control rather than an architectural change; it would catch some stale accounts but leave up to a year of exposure and still depends on 40 separate efforts. Stronger password complexity in each application does nothing to remove accounts that should no longer exist; a departed employee with a valid strong password still has access. Encrypting each user store protects the stored credentials from theft but does not change who holds valid accounts, so orphaned access persists. Exam caveat: centralizing identity raises the importance of protecting the identity platform itself, so its resilience and privileged administration become critical risks to manage. Operational check: measure the share of applications authenticating through the central directory and the time between a departure recorded by HR and the disabling of all associated access.