Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A global retail company is planning its peak shopping season operations in Azure. The security architecture team needs to delegate temporary administrative access to the Site Reliability Engineering (SRE) team to manage Azure Kubernetes Service (AKS) clusters during maintenance windows. The design must ensure zero-standing administrative privileges, adhere to the principle of least administrative overhead for user management, and protect the tenant against lockouts.

Which of the following actions should you include in the identity governance and privileged access design? (Select TWO.)

  1. Create a Microsoft Entra ID security group for the SRE team, and make this group eligible for the required Azure RBAC roles in Privileged Identity Management (PIM).Answer
  2. Exclude emergency-access (break-glass) accounts from any Conditional Access policies that enforce multi-factor authentication (MFA) for administrative roles.Answer
  3. C
    Assign the required Azure RBAC roles directly to each individual SRE user account as eligible assignments in Privileged Identity Management (PIM).
  4. D
    Configure the Azure RBAC role assignments for the SRE team as permanently active roles in Privileged Identity Management (PIM).

Answer

Create a Microsoft Entra ID security group for the SRE team and make it eligible for Azure RBAC roles in PIM, and exclude emergency-access accounts from Conditional Access policies enforcing MFA.
Minimizing administrative overhead and enforcing zero-standing access is achieved by assigning SREs to a security group and making that group eligible for the target roles in PIM. To prevent complete tenant lockout, emergency-access accounts must be excluded from strict Conditional Access policies requiring MFA.

Step-by-Step Solution

1
Analyze requirements for zero-standing privileges and minimal user-management overhead.
Identify that Privileged Identity Management (PIM) with eligible assignments should be used, and the roles should be assigned to a security group rather than individual users.
Eligible role assignments require activation on-demand to achieve zero-standing privileges, while assigning roles to groups simplifies administration.
2
Address the requirement to prevent tenant lockout during administrative access configurations.
Determine that emergency-access (break-glass) accounts must be excluded from multi-factor authentication (MFA) requirements in Conditional Access.
Failing to exclude break-glass accounts from MFA policies risks a total tenant lockout if the MFA service encounters an outage.

Key Concept

Designing secure identity delegation using Microsoft Entra Privileged Identity Management (PIM) eligible groups and ensuring emergency lockout protection.
Estimated Time:2m 0s
Rate this question

Topics

Entra ID Governance and Privileged Access