Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

An organization is designing an identity governance and privileged access solution for external database administrators who require temporary access to manage an Azure SQL Managed Instance. The solution must meet the following requirements:
- Administrators must request access on-demand (just-in-time) for a duration of no more than 6 hours.
- Multi-factor authentication (MFA) must be enforced during the role activation process.
- The design must minimize administrative overhead and avoid assigning roles directly to individual user accounts.
- To prevent tenant lockout during a regional identity provider disruption, emergency break-glass accounts must be protected from being locked out by MFA policies.

Which configuration should you recommend to meet these requirements?

  1. Create a Microsoft Entra ID security group, assign the required Azure RBAC roles to this group, configure eligible memberships for the administrators using Microsoft Entra Privileged Identity Management (PIM) for Groups with activation MFA enabled, and exclude emergency access accounts from Conditional Access MFA policies.Answer
  2. B
    Assign the required Azure RBAC roles directly to each database administrator's user account, configure the assignments as eligible in Privileged Identity Management (PIM) with activation MFA enabled, and exclude emergency access accounts from Conditional Access MFA policies.
  3. C
    Create a Microsoft Entra ID security group, assign the required Azure RBAC roles to this group, configure the database administrators' membership in the group as active permanent assignments in PIM, and create a Conditional Access policy requiring MFA for the group while excluding emergency access accounts.
  4. D
    Create a Microsoft Entra ID security group, assign the required Azure RBAC roles to this group, configure eligible memberships for the administrators using PIM for Groups with activation MFA enabled, and apply a strict tenant-wide Conditional Access policy enforcing MFA for all administrators without any exclusions.

Answer

Create a Microsoft Entra ID security group, assign the required Azure RBAC roles to this group, configure eligible memberships for the administrators using Microsoft Entra Privileged Identity Management (PIM) for Groups with activation MFA enabled, and exclude emergency access accounts from Conditional Access MFA policies.
The correct solution leverages Microsoft Entra Privileged Identity Management (PIM) for Groups to assign the Azure RBAC roles to a group rather than to individual users, reducing overhead. By making the users eligible members and requiring MFA on activation, it achieves JIT access for up to 6 hours. Finally, excluding emergency break-glass accounts from tenant-wide Conditional Access MFA policies ensures that administrators can still log in to recover the tenant during a major MFA outage.

Step-by-Step Solution

1
Determine the resource authorization structure that minimizes administrative overhead.
Identify that assigning Azure RBAC roles to a Microsoft Entra ID security group instead of individual accounts reduces overhead and supports scalable governance.
Direct RBAC assignments to individuals violate the group-based access control principle and increase administrative complexity.
2
Select the just-in-time (JIT) access mechanism.
Configure Privileged Identity Management (PIM) for Groups, setting the external database administrators as eligible members rather than active permanent members.
PIM for Groups ensures that memberships are only active when requested and automatically expire after the 6-hour limit, satisfying JIT requirements.
3
Apply multi-factor authentication (MFA) to the activation process.
Enable the MFA requirement in the PIM group activation settings.
This guarantees that users must verify their identity using MFA when they elevate their access, without needing a persistent Conditional Access policy that could interfere with other scenarios.
4
Address the resiliency and lockout requirements for emergency access.
Ensure emergency break-glass accounts are explicitly excluded from all tenant-wide Conditional Access MFA policies.
Excluding emergency accounts prevents administrative lockout in the event of an identity provider or MFA system outage.

Key Concept

Designing secure, JIT, and highly resilient administrative access using PIM for Groups and Conditional Access exclusions.
Rate this question

Topics

Entra ID Governance and Privileged Access