Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A logistics corporation is designing a privileged identity architecture for its IT operations team. The team has 12 administrators who require the User Access Administrator role to manage permissions across several subscription groups. The design must ensure that these administrators do not have permanent administrative rights, must perform multi-factor authentication (MFA) to activate their privileges, and that the organization's break-glass accounts are never locked out of the tenant by conditional access policies. Which two configurations should you include in the identity design to meet these requirements?

  1. Create a Microsoft Entra ID security group for the IT operations team, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM).Answer
  2. Create a Conditional Access policy requiring multi-factor authentication (MFA) for administrative role activation, and add the emergency break-glass accounts to the exclusion list of this policy.Answer
  3. C
    Configure Privileged Identity Management (PIM) assignments as permanently active for each individual administrator to ensure direct and uninterrupted access.
  4. D
    Configure a Conditional Access policy that enforces multi-factor authentication (MFA) for all administrative role activations, ensuring no accounts are excluded to maintain a uniform security baseline.

Answer

The correct design includes configuring a Microsoft Entra ID group for the administrators, making that group eligible for the User Access Administrator role in Privileged Identity Management (PIM), and creating a Conditional Access policy requiring multi-factor authentication (MFA) for activation while excluding break-glass accounts.
The correct configurations ensure just-in-time access and robust recovery paths. Using a Microsoft Entra ID security group assigned as eligible for the User Access Administrator role in Privileged Identity Management (PIM) avoids direct user assignment and enforces the principle of least privilege. Requiring multi-factor authentication (MFA) for role activation secures the identity verification process, and explicitly excluding emergency break-glass accounts from this Conditional Access policy prevents administrative lockout during authentication service disruptions.

Step-by-Step Solution

1
Identify the group assignment strategy for administrative roles.
Create a Microsoft Entra ID security group containing the 12 administrators.
Assigning roles to groups instead of individual users is an Azure best practice that reduces administrative overhead and ensures scalability.
2
Determine the activation policy in Privileged Identity Management (PIM).
Assign the security group as eligible, not active, for the User Access Administrator role.
Eligible assignments support just-in-time (JIT) access, ensuring administrators do not hold standing privileges when they do not need them.
3
Enforce multi-factor authentication (MFA) for role activation while securing emergency access.
Apply a Conditional Access policy requiring MFA for role activation, and add emergency break-glass accounts to the policy's exclusion list.
This secures the activation path with MFA but prevents tenant lockout if there is an MFA system outage.

Key Concept

Privileged identity governance and emergency access design in Microsoft Entra ID
Estimated Time:2m 0s
Rate this question

Topics

Entra ID Governance and Privileged Access