Examkin

Question

Difficulty: HardAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance strategy for a multi-region deployment consisting of 12 Azure subscriptions. The subscriptions are grouped under a single department-level Management Group. A security audit team consisting of 15 members requires read-only access to all resources within these subscriptions to perform periodic audits.

The solution must satisfy the following requirements:
- Access must be granted only when actively auditing and must automatically expire after 8 hours.
- Access requests must require approval from the security manager.
- The solution must minimize administrative overhead and enforce the principle of least privilege.

Which configuration should you recommend to meet these requirements?

  1. A
    Create a Microsoft Entra ID security group containing the audit team members. Assign the Reader role permanently to the security group at the Management Group scope. Use Azure Policy with a Deny effect to block resource access outside the designated audit windows.
  2. B
    Create guest accounts for each auditor. In Microsoft Entra PIM, configure each user account individually with an eligible assignment for the Reader role at the Management Group scope, requiring approval and a maximum activation duration of 8 hours.
  3. Create a Microsoft Entra ID security group containing the audit team members. Configure a Microsoft Entra Privileged Identity Management (PIM) eligible group assignment for the Reader role at the Management Group scope, requiring approval and setting a maximum activation duration of 8 hours.Answer
  4. D
    Create a Microsoft Entra ID security group containing the audit team members. In Microsoft Entra PIM, assign the group to the Reader role at the Management Group scope, configuring the assignment type as active with a maximum duration of 8 hours.

Answer

Create a Microsoft Entra ID security group containing the audit team members, and configure a Microsoft Entra Privileged Identity Management (PIM) eligible group assignment for the Reader role at the Management Group scope, requiring approval and setting a maximum activation duration of 8 hours.
The correct configuration uses group-based access control combined with Microsoft Entra Privileged Identity Management (PIM) at the Management Group scope. By defining the security group as eligible rather than active, the audit team members must request activation to obtain the Reader role. This request goes through an approval workflow and automatically expires after the configured 8-hour duration, fully aligning with the principle of least privilege.

Step-by-Step Solution

1
Consolidate the users into a single administrative unit by creating a Microsoft Entra ID security group and adding all 15 audit team members as members.
This satisfies the requirement to minimize administrative overhead by avoiding individual user assignments.
Identity governance best practices dictate managing access via security groups rather than individual user accounts.
2
Configure the security group as eligible for the Reader role at the Management Group scope containing the 12 subscriptions in Microsoft Entra PIM.
The Reader permissions are inherited by all subscriptions within the Management Group hierarchy, ensuring full audit visibility.
Assigning permissions at the Management Group scope ensures that permissions inherit down to all child subscriptions automatically.
3
Configure the PIM role settings for the Reader role to require approval from the security manager and limit the maximum activation duration to 8 hours.
Auditors must explicitly request activation, which requires approval and automatically revokes access after 8 hours.
This implements the just-in-time (JIT) access model and enforces the principle of least privilege.

Key Concept

Just-in-Time (JIT) access governance using Microsoft Entra PIM and group-based RBAC at the Management Group scope.
Rate this question

Topics

Azure RBAC and Subscription Governance