Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A global manufacturing company is designing an identity governance and access solution for its IT operations team. The team needs to occasionally perform security administrator tasks in Microsoft Entra ID. The solution must ensure that administrative permissions are not active by default, require multi-factor authentication (MFA) and a business justification to activate, and follow administrative best practices for scalability. Additionally, the company wants to ensure that their disaster recovery planning includes preventing tenant lockout for their break-glass accounts. Which of the following designs should you recommend to meet these requirements?

  1. Create a Microsoft Entra ID security group, assign the IT operations team members to the group, configure the group as eligible for the Security Administrator role in Privileged Identity Management (PIM), and exclude emergency access accounts from the administrative Conditional Access MFA policies.Answer
  2. B
    Configure each IT operations team member as eligible for the Security Administrator role in Privileged Identity Management (PIM) directly at the user level, and exclude emergency access accounts from the administrative Conditional Access MFA policies.
  3. C
    Create a Microsoft Entra ID security group, assign the IT operations team members to the group, configure the group with an active assignment for the Security Administrator role in Privileged Identity Management (PIM), and exclude emergency access accounts from the administrative Conditional Access MFA policies.
  4. D
    Create a Microsoft Entra ID security group, assign the IT operations team members to the group, configure the group as eligible for the Security Administrator role in Privileged Identity Management (PIM), and apply the administrative Conditional Access MFA policies to all administrator accounts without excluding emergency access accounts.

Answer

Create a Microsoft Entra ID security group, assign the IT operations team members to the group, configure the group as eligible for the Security Administrator role in Privileged Identity Management (PIM), and exclude emergency access accounts from the administrative Conditional Access MFA policies.
The correct design creates a Microsoft Entra ID security group for group-based PIM assignment, configures eligibility to ensure just-in-time access, and excludes emergency access accounts from Conditional Access MFA policies to prevent lockout.

Step-by-Step Solution

1
Evaluate group-based management for scalable administration of administrative roles in Microsoft Entra ID.
Determine that IT operations team members must be placed in a security group rather than assigned roles directly to minimize administrative overhead.
Assigning roles directly to individual users violates scalability best practices.
2
Determine the appropriate Privileged Identity Management (PIM) assignment type to satisfy the requirement that permissions are not active by default.
Configure the security group's assignment as eligible rather than permanently active.
Eligible assignments require users to perform just-in-time activation, including justification and MFA, adhering to the principle of least privilege.
3
Identify the configuration needed to prevent tenant lockout during MFA enforcement.
Exclude emergency access (break-glass) accounts from strict Conditional Access MFA policies.
Ensures administrative access to the tenant remains possible even if there is an MFA service disruption or credential loss.

Key Concept

Privileged Identity Management group-based eligibility and emergency access exclusions
Estimated Time:1m 30s
Rate this question

Topics

Entra ID Governance and Privileged Access