Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A multinational financial services enterprise is designing a privileged access governance and identity protection strategy for its Azure tenant. The design must satisfy the following administrative and security requirements:
- System administrators must only be granted the User Access Administrator and Contributor roles on an as-needed basis for troubleshooting subscription-level issues, with all sessions automatically expiring after a maximum of 4 hours.
- In the event of a tenant-wide identity outage or Conditional Access misconfiguration, administrators must be able to log in using emergency break-glass accounts without being blocked by multi-factor authentication (MFA) requirements.
Which two of the following configurations should you include in the identity and governance design?

  1. Configure Microsoft Entra Privileged Identity Management (PIM) for subscription roles, assigning the User Access Administrator and Contributor roles as eligible to an Entra ID security group containing the system administrators.Answer
  2. Exclude the emergency break-glass accounts from all Microsoft Entra Conditional Access policies that enforce multi-factor authentication (MFA).Answer
  3. C
    Configure Microsoft Entra Privileged Identity Management (PIM) roles as permanently active for the individual system administrator accounts to guarantee immediate availability.
  4. D
    Assign the User Access Administrator and Contributor roles directly to each individual system administrator's user account with a start and end time matching their shift schedule.
  5. E
    Apply a Conditional Access policy that enforces MFA for all accounts in the tenant, including the emergency break-glass accounts, to maintain complete compliance baseline coverage.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for subscription roles, assigning the User Access Administrator and Contributor roles as eligible to an Entra ID security group containing the system administrators; and exclude the emergency break-glass accounts from all Microsoft Entra Conditional Access policies that enforce multi-factor authentication (MFA).
To satisfy the requirement of granting subscription-level admin roles on an as-needed basis with a 4-hour limit, the design must use Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments targeting a security group containing the system administrators. To satisfy the emergency access requirement, the break-glass accounts must be excluded from all Conditional Access policies enforcing MFA, ensuring they can be used to log in and resolve issues during an identity service outage or policy misconfiguration.

Step-by-Step Solution

1
Evaluate the requirement for just-in-time (JIT) administrative access with a 4-hour expiration limit.
Identify that Microsoft Entra Privileged Identity Management (PIM) with eligible assignments is required to enforce dynamic activation and time-bound access, and that these assignments should target an Entra ID security group containing the administrators rather than individual accounts.
This enforces scale and follows the Azure administrative best practice of group-based delegation combined with JIT.
2
Evaluate the requirement for emergency access during tenant outages or Conditional Access misconfigurations.
Identify that emergency break-glass accounts must be explicitly excluded from any Conditional Access policies that enforce multi-factor authentication.
If an outage affects the MFA service or if a misconfigured policy blocks all standard access, the excluded break-glass accounts can still sign in to restore access.

Key Concept

Microsoft Entra Privileged Identity Management (PIM) eligible group assignments combined with Conditional Access exclusions for emergency break-glass accounts.
Rate this question

Topics

Entra ID Governance and Privileged Access