A digital media company is designing a subscription governance strategy for a dedicated rendering subscription in Azure. The strategy must satisfy the following requirements:
* A team of external editors must be able to manage virtual machines and storage accounts within the subscription.
* The editors' access must be restricted to scheduled editing windows and must not be permanently active.
* Administrative overhead must be minimized by avoiding permissions assigned directly to individual user accounts.
* Any new storage account deployed in the subscription must be automatically configured to use customer-managed keys (CMKs) to satisfy compliance audits.
Which governance configuration should you recommend to meet these requirements?
- AAssign the Virtual Machine Contributor and Storage Account Contributor roles directly to each editor's individual user account at the subscription scope, configure their access as eligible using Privileged Identity Management (PIM) for Azure resources, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.
- BAssign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, configure the editors as permanent members of the security group, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.
- Assign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, manage the editors' access as eligible group members using Privileged Identity Management (PIM) for Groups, and deploy an Azure Policy with a DeployIfNotExists effect to automatically configure customer-managed keys for new storage accounts.Answer
- DAssign the Virtual Machine Contributor and Storage Account Contributor roles to a Microsoft Entra security group at the subscription scope, manage the editors' access as eligible group members using Privileged Identity Management (PIM) for Groups, and deploy an Azure Policy with a Deny effect to block the creation of any storage account that does not have customer-managed keys configured.
Answer
Assign the roles to a security group, configure eligible membership via Privileged Identity Management (PIM) for Groups, and implement an Azure Policy with a DeployIfNotExists effect.
To minimize administrative overhead and ensure scalability, permissions should be assigned to a group rather than individual users. Utilizing Privileged Identity Management (PIM) for Groups with eligible membership allows for just-in-time access control, ensuring editors only have access during their scheduled windows. To enforce automatic configuration of customer-managed keys for compliance without blocking deployments, an Azure Policy with a DeployIfNotExists effect is the correct choice as it can remediate non-compliant resources upon creation.
Step-by-Step Solution
Key Concept
Subscription Governance and Least Privilege Access Control