Your company is designing the subscription governance and access control model for a new Azure subscription. You need to grant a team of ten developers the ability to manage virtual machines in the subscription. The solution must adhere to the principles of least privilege, minimize administrative overhead, and ensure that administrative access is granted only when required. Which two configurations should you implement? (Select two.)
- Assign the Virtual Machine Contributor role to a Microsoft Entra ID security group that contains the developer accounts.Answer
- Configure the group's role assignment in Microsoft Entra Privileged Identity Management (PIM) as eligible.Answer
- CAssign the Virtual Machine Contributor role directly to each developer's Microsoft Entra ID user account.
- DConfigure the role assignment in Microsoft Entra Privileged Identity Management (PIM) as permanently active.
Answer
Assign the Virtual Machine Contributor role to a Microsoft Entra ID security group that contains the developer accounts, and configure the group's role assignment in Microsoft Entra Privileged Identity Management (PIM) as eligible.
To satisfy subscription governance and least privilege, permissions should be assigned to a Microsoft Entra ID security group to minimize overhead, and the group should be configured as eligible in Microsoft Entra PIM to ensure that administrative permissions are activated only when needed.
Step-by-Step Solution
Key Concept
Azure RBAC best practices advocate assigning roles to security groups rather than individual users, and using Microsoft Entra PIM with eligible assignments to enforce just-in-time, least-privilege access.
Estimated Time:45s