A biotechnology firm is designing a secure identity governance strategy for its clinical trial data analysts who require temporary write access to multiple Azure Data Lake Storage Gen2 accounts. The access must be time-bound to a maximum of 4 hours per session, require multi-factor authentication (MFA) upon activation, be easily reviewed on a quarterly basis, and avoid individual role assignments to minimize administrative overhead. Which two of the following configuration options should you include in the design to meet these requirements?
- Create a role-assignable Microsoft Entra security group, assign the Storage Blob Data Contributor role to the group for the storage accounts, and configure the analysts as eligible members of the group in PIM for Groups.Answer
- Configure a Microsoft Entra access review targeted at the security group's membership and schedule it to recur quarterly.Answer
- CAssign the Storage Blob Data Contributor role directly to each data analyst's user account, configuring the PIM assignments as permanently active.
- DExclude the research analyst group from Multi-Factor Authentication requirements in Conditional Access to simplify the elevation process.
Answer
The correct configurations are to create a role-assignable Microsoft Entra security group with the required role and PIM for Groups eligibility, and to configure a quarterly access review on the group's membership.
To meet the requirements, you should create a role-assignable security group, assign the required role to it, and configure PIM for Groups to manage user eligibility with a 4-hour activation limit and MFA requirement. Additionally, a quarterly access review on the group's membership ensures governance compliance.
Step-by-Step Solution
Key Concept
Entra ID Governance, PIM for Groups, and Access Reviews