Examkin

Question

Difficulty: EasyEntra ID Governance and Privileged Access

A logistics company needs to grant five IT support technicians the capability to manage Azure resources, but only when they are actively resolving support tickets. You need to design a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM) that ensures administrative access is time-bound and adheres to identity governance best practices. Which of the following configurations should you include in your design? (Select TWO.)

  1. A
    Assign the target Azure roles directly to the individual user accounts of the technicians.
  2. B
    Configure the security group's assignment in Microsoft Entra PIM as permanently Active.
  3. Assign the target Azure roles to a Microsoft Entra security group.Answer
  4. Configure the security group's assignment in Microsoft Entra PIM as Eligible.Answer

Answer

The correct approach is to assign the target Azure roles to a Microsoft Entra security group and configure the security group's assignment in Microsoft Entra PIM as Eligible.
Assigning the target Azure roles to a Microsoft Entra security group adheres to the best practice of managing access at the group level rather than the individual level. Configuring the security group's assignment in Microsoft Entra PIM as Eligible ensures that the support technicians do not hold standing privileges and must explicitly activate their access when performing tasks, fulfilling the requirement for time-bound access.

Step-by-Step Solution

1
Evaluate the administrative delegation model.
Identify that assigning roles directly to user accounts is difficult to manage at scale.
Assigning roles to a Microsoft Entra security group simplifies administration and follows governance best practices.
2
Determine the PIM assignment type.
Decide that the assignment must be Eligible rather than Active.
An Eligible assignment requires users to perform just-in-time activation to receive the permissions, whereas an Active assignment grants permanent permissions, violating the principle of least privilege.

Key Concept

Microsoft Entra PIM supports group-based role assignments and eligible states to enforce just-in-time access and scalable governance.
Estimated Time:45s
Rate this question

Topics

Entra ID Governance and Privileged Access