Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A smart-grid utility provider is designing an identity governance and privileged access solution to comply with regional energy infrastructure regulations. The company must allow an external security team consisting of five auditors to review the configuration of all Azure resources across three production subscriptions for a limited period of 30 days. The auditors require read-only access.

The solution must meet the following requirements:
- Ensure the auditors must request approval and perform multi-factor authentication (MFA) each time they access the subscriptions.
- Minimize administrative overhead when managing access for the five external auditors.
- Prevent administrative tenant lockout in the event of an MFA service outage.

Which solution should you recommend?

  1. A
    In Privileged Identity Management (PIM), configure an eligible assignment for each individual auditor account to the Reader role at the subscription level, with a 30-day assignment lifetime. Exclude emergency access accounts from the Conditional Access policy that enforces MFA.
  2. Create a Microsoft Entra security group containing the five auditors. In Privileged Identity Management (PIM), configure an eligible assignment for the group to the Reader role at the subscription level, with a 30-day assignment lifetime. Exclude emergency access accounts from the Conditional Access policy that enforces MFA.Answer
  3. C
    Create a Microsoft Entra security group containing the five auditors. Assign the group an active Reader role at the subscription level. In Privileged Identity Management (PIM), set the assignment duration to 30 days. Exclude emergency access accounts from the Conditional Access policy that enforces MFA.
  4. D
    Create a Microsoft Entra security group containing the five auditors. In Privileged Identity Management (PIM), configure an eligible assignment for the group to the Reader role at the subscription level, with a 30-day assignment lifetime. Apply the Conditional Access policy enforcing MFA to all directory accounts, including emergency access accounts.

Answer

Create a Microsoft Entra security group containing the five auditors. In Privileged Identity Management (PIM), configure an eligible assignment for the group to the Reader role at the subscription level, with a 30-day assignment lifetime. Exclude emergency access accounts from the Conditional Access policy that enforces MFA.
The correct solution involves creating a Microsoft Entra security group to hold the auditor accounts, which minimizes administrative overhead. By configuring the security group's assignment to the Reader role as eligible in Privileged Identity Management (PIM) rather than active, the auditors are required to perform multi-factor authentication (MFA) and request approval to activate the role only when needed (just-in-time access). Finally, excluding the emergency access accounts from the Conditional Access policy enforcing MFA prevents tenant lockout in case of an MFA service failure.

Step-by-Step Solution

1
Group external users to minimize overhead
Create a Microsoft Entra security group and add the five external auditor accounts as members, allowing role assignments to be managed collectively.
Directly assigning roles to multiple individual accounts increases administrative complexity and overhead.
2
Enforce just-in-time (JIT) access using Privileged Identity Management (PIM)
Configure the security group with an eligible assignment for the Reader role at the subscription level, set with a maximum lifetime of 30 days.
This guarantees that permissions are not permanently active, requiring the auditors to activate the role and authenticate via MFA on demand.
3
Configure emergency access account exclusion
Exclude emergency access (break-glass) accounts from the Conditional Access policy that enforces MFA.
This ensures that administrators can still access the tenant to resolve issues during an MFA service outage, preventing lockout.

Key Concept

Privileged Identity Management (PIM) eligibility combined with Microsoft Entra group management and break-glass account governance.
Rate this question

Topics

Entra ID Governance and Privileged Access