Examkin

Question

Difficulty: EasyEntra ID Governance and Privileged Access

An enterprise wants to secure administrative access to their production Azure subscriptions. You are designing an identity governance solution for system administrators who require the Owner role. To comply with security best practices, the administrators must not have permanent Owner privileges, but must be able to request and activate the role for a maximum of 4 hours when performing changes. Which configuration should you design to meet this requirement?

  1. Configure Microsoft Entra Privileged Identity Management (PIM) and define the Owner role assignments for the administrators as eligible.Answer
  2. B
    Configure Microsoft Entra Privileged Identity Management (PIM) and define the Owner role assignments for the administrators as permanently active.
  3. C
    Assign the Owner role directly to each administrator's individual user account with a permanent subscription-level assignment.
  4. D
    Create a security group for the administrators and exclude this group from all Conditional Access multi-factor authentication policies.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) and define the Owner role assignments for the administrators as eligible.
Configuring the Owner role assignments as eligible in Microsoft Entra Privileged Identity Management (PIM) ensures that administrators do not have standing, permanent privileges. Instead, they must request activation when needed, which can be restricted to a maximum duration of 4 hours, satisfying the security requirements.

Step-by-Step Solution

1
Analyze the business and security requirements.
Identified the need for non-permanent, time-bound (maximum 4 hours), and just-in-time (JIT) administrative access for the highly privileged Owner role.
This establishes the core functional requirements for the identity governance design.
2
Select the appropriate Azure governance tool.
Determined that Microsoft Entra Privileged Identity Management (PIM) is the standard tool designed for managing, controlling, and monitoring access to important resources in Azure.
PIM provides the capabilities required for JIT access and time-bound activations.
3
Select the proper assignment type within the chosen tool.
Configured the role assignments as 'eligible' rather than 'active'.
Eligible assignments require the user to explicitly perform an activation process (which can be restricted to 4 hours), whereas active assignments grant persistent privileges without requiring activation.

Key Concept

Just-In-Time (JIT) privileged access management using Microsoft Entra Privileged Identity Management (PIM) role eligibility.
Rate this question

Topics

Entra ID Governance and Privileged Access