Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

An enterprise is designing a secure identity governance strategy for its cloud administration team. The strategy must satisfy the following requirements:
- Administrators must only hold highly privileged directory roles on a temporary, just-in-time (JIT) basis.
- When administrators activate and use these roles, they must be prompted for multi-factor authentication (MFA) and must connect from a compliant device.
- The design must guarantee that the organization does not lose administrative access to the Microsoft Entra tenant if a widespread multi-factor authentication outage or device compliance system failure occurs.
- On-premises infrastructure footprint and configuration complexity must be minimized.

Which design should you recommend?

  1. Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrative roles. Create a Microsoft Entra Conditional Access policy that targets these directory roles and requires MFA and device compliance, and explicitly exclude a designated, cloud-only emergency access account from this policy.Answer
  2. B
    Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrative roles. Create a Microsoft Entra Conditional Access policy requiring MFA and device compliance for all directory roles, and apply this policy to all administrative accounts, including emergency access accounts, to ensure complete security coverage.
  3. C
    Configure active assignments in Microsoft Entra Privileged Identity Management (PIM) for the administrative roles so they are permanently assigned. Create a Microsoft Entra Conditional Access policy that requires MFA and device compliance, and exclude a cloud-only emergency access account from this policy.
  4. D
    Deploy Active Directory Federation Services (AD FS) to handle all authentication requests and enforce security claims for administrators. Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) and use AD FS relying party trust claims to enforce MFA and device compliance.

Answer

Configure eligible assignments in Microsoft Entra Privileged Identity Management (PIM) for administrative roles, enforce MFA and device compliance with a Microsoft Entra Conditional Access policy targeting those roles, and exclude a cloud-only emergency access account from the policy.
The correct design uses Microsoft Entra PIM with eligible assignments to enforce just-in-time administrative access, applies a Conditional Access policy to target directory roles for MFA and compliant devices, and excludes an emergency access account to prevent lockout. This achieves high security and business continuity with zero on-premises footprint.

Step-by-Step Solution

1
Evaluate the just-in-time (JIT) requirement.
Determine that Microsoft Entra Privileged Identity Management (PIM) must be used with eligible assignments.
Eligible assignments require administrators to explicitly activate their roles when needed rather than holding privileges permanently, satisfying JIT requirements.
2
Address the multi-factor authentication (MFA) and device compliance requirements for privileged sessions.
Design a Microsoft Entra Conditional Access policy that triggers when directory roles are active and enforces MFA and device compliance.
Conditional Access policies can target specific directory roles, ensuring that elevated privileges are protected by strong authentication and device health checks.
3
Design resilience against authentication service outages and tenant lockouts.
Create a designated, cloud-only emergency access (break-glass) account and exclude it from the Conditional Access policy.
Excluding the emergency access account ensures that administrators can still log in using standard credentials to resolve configuration or authentication provider issues if Entra ID MFA or compliance services fail.
4
Minimize on-premises infrastructure footprint and complexity.
Select cloud-native identity controls instead of deploying federated authentication via AD FS.
AD FS requires on-premises server infrastructure, security certificates, and management overhead, whereas Microsoft Entra ID cloud-native features meet all requirements natively.

Key Concept

Designing secure, resilient administrative access by combining Microsoft Entra PIM, Conditional Access, and emergency exclusion practices.
Estimated Time:2m 30s
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access