Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

A multi-region retail enterprise is establishing a new environment in Azure for its inventory forecasting service. The service is hosted within a dedicated subscription. The operations team consists of 15 system administrators who require contributor permissions at the subscription scope to troubleshoot infrastructure issues. The company's security policy mandates that administrators must not hold permanent high-privilege access, and all access assignments must minimize administrative overhead while ensuring full auditability of elevated permissions.

Which approach should you recommend to meet these requirements?

  1. A
    Configure Microsoft Entra Privileged Identity Management (PIM) to make each of the 15 system administrators individually eligible for the Contributor role at the subscription scope.
  2. Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group eligible for the Contributor role at the subscription scope, and add the 15 system administrators as members of the group.Answer
  3. C
    Create a Microsoft Entra ID security group containing the 15 system administrators, and configure a permanent active Contributor role assignment for the security group at the subscription scope in Privileged Identity Management (PIM).
  4. D
    Assign an Azure Policy with a Deny effect to enforce resource tagging compliance at the subscription scope rather than a DeployIfNotExists effect, and grant permanent Contributor access directly to each administrator.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group eligible for the Contributor role at the subscription scope, and add the 15 system administrators as members of the group.
The correct design uses Microsoft Entra Privileged Identity Management (PIM) to assign a security group as eligible for the Contributor role. This meets the security requirement for just-in-time (JIT) access with full auditing, while assigning the role to a security group instead of individual users minimizes administrative overhead and aligns with governance best practices.

Step-by-Step Solution

1
Group administrators in Microsoft Entra ID
A security group is created containing all 15 system administrators.
This simplifies management and aligns with administrative delegation best practices by avoiding direct user role assignments.
2
Configure role eligibility in Privileged Identity Management
The Contributor role at the subscription scope is assigned to the security group as an 'eligible' assignment.
This ensures that administrators must explicitly activate their roles when troubleshooting, enforcing the principle of least privilege through just-in-time access.
3
Enforce auditing and activation requirements
Administrators can activate their eligible role when needed, generating an audit trail of the elevation event.
This satisfies the governance requirement that all elevation events must be monitored and audited.

Key Concept

Azure RBAC, subscription governance, and PIM group-based eligible assignments
Estimated Time:2m 0s
Rate this question

Topics

Azure RBAC and Subscription Governance