Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A financial services company is designing a privileged access governance solution for its Azure environment. The solution must meet the following requirements:

* Members of the IT security department must be able to assume the Security Administrator role on a temporary basis, not exceeding 4 hours per session, requiring Multi-Factor Authentication (MFA) and Chief Information Security Officer (CISO) approval.
* An emergency 'break-glass' administrative account must be maintained to prevent tenant lockout, ensuring it is exempt from the standard MFA requirements in the event of an identity provider outage.
* Administrative overhead for managing individual user role assignments must be minimized.

Which combination of configuration actions should you recommend?

  1. Configure the Security Administrator role in Microsoft Entra Privileged Identity Management (PIM) to require MFA, approval, and a maximum activation duration of 4 hours. Assign the IT security department's Microsoft Entra ID group as eligible for the role. Configure a Conditional Access policy requiring MFA for administrator roles, but exclude the emergency break-glass account from the policy.Answer
  2. B
    Configure the Security Administrator role in Microsoft Entra Privileged Identity Management (PIM) to require MFA, approval, and a maximum activation duration of 4 hours. Assign the Security Administrator role directly to each individual IT security staff member's user account. Configure a Conditional Access policy requiring MFA for administrator roles, but exclude the emergency break-glass account from the policy.
  3. C
    Configure the Security Administrator role in Microsoft Entra Privileged Identity Management (PIM) to require MFA, approval, and a maximum activation duration of 4 hours. Assign the IT security department's Microsoft Entra ID group with permanently active assignments to the role. Configure a Conditional Access policy requiring MFA for administrator roles, but exclude the emergency break-glass account from the policy.
  4. D
    Configure the Security Administrator role in Microsoft Entra Privileged Identity Management (PIM) to require MFA, approval, and a maximum activation duration of 4 hours. Assign the IT security department's Microsoft Entra ID group as eligible for the role. Configure a Conditional Access policy requiring MFA for all administrator roles and accounts, without configuring any exclusions.

Answer

Configure the Security Administrator role in Microsoft Entra Privileged Identity Management (PIM) to require MFA, approval, and a maximum activation duration of 4 hours; assign the group as eligible; and configure a Conditional Access policy requiring MFA while excluding the emergency account.
The correct option addresses all three design goals: it uses Microsoft Entra Privileged Identity Management (PIM) with group-based eligibility (minimizing administrative overhead) and enforces the 4-hour activation limit with CISO approval and MFA. Furthermore, it creates a Conditional Access policy requiring MFA for administrative actions while keeping the emergency break-glass account excluded to prevent tenant lockout.

Step-by-Step Solution

1
Evaluate the requirement for temporary access and approval for the Security Administrator role.
Microsoft Entra Privileged Identity Management (PIM) is identified as the tool to enforce just-in-time (JIT) access, allowing a maximum activation duration of 4 hours, CISO approval, and MFA verification during activation.
PIM role settings allow granular control over role activation parameters including duration and approval workflows.
2
Address the requirement to minimize administrative overhead for role assignments.
The IT security department's group should be assigned as eligible for the role in PIM, rather than assigning individual users.
Group-based role assignment ensures that additions or removals of staff members do not require manual role reconfiguration, simplifying access governance.
3
Review the requirement to protect the emergency account from lockout.
The Conditional Access policy enforcing MFA for administrative roles must explicitly exclude the emergency break-glass account.
Emergency accounts must be accessible even when the primary MFA provider is unavailable; failing to exclude them violates resilience best practices.

Key Concept

Privileged Identity Management (PIM) settings, group-based assignments, and Conditional Access policies with emergency exclusions.
Estimated Time:2m 0s
Rate this question

Topics

Entra ID Governance and Privileged Access