Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

A global pharmaceutical corporation is designing an identity governance and privileged access solution to manage external clinical researchers who require temporary, administrative access to Azure Machine Learning workspaces in a production subscription. The researchers must only acquire permissions when active, and their access must be automatically re-evaluated monthly to ensure compliance with data protection laws. All administrative activities must require Multi-Factor Authentication (MFA), but the organization's break-glass emergency accounts must never be locked out by these requirements.

Which configuration should you recommend to meet these requirements with the least administrative overhead?

  1. A
    Assign each researcher's user account individually as eligible for the Contributor role in Privileged Identity Management (PIM) for Azure resources, require MFA during activation, configure a monthly PIM access review for each user, and ensure the emergency access accounts are excluded from the tenant-wide Conditional Access policy that enforces MFA.
  2. B
    Create a Microsoft Entra ID security group for the researchers, assign the group as active for the Contributor role in Privileged Identity Management (PIM) for Azure resources, rely on a tenant-wide Conditional Access policy enforcing MFA, and exclude the emergency access accounts from the policy.
  3. Create a Microsoft Entra ID security group for the researchers, assign the group as eligible for the Contributor role in Privileged Identity Management (PIM) for Azure resources, require MFA during activation, configure a monthly PIM access review for the role assignment, and ensure the emergency access accounts are excluded from the tenant-wide Conditional Access policy that enforces MFA.Answer
  4. D
    Create a Microsoft Entra ID security group for the researchers, assign the group as eligible for the Contributor role in Privileged Identity Management (PIM) for Azure resources, require MFA during activation, configure a monthly PIM access review for the role assignment, and implement a tenant-wide Conditional Access policy that enforces MFA for all administrative roles, including the emergency access accounts.

Answer

Create a Microsoft Entra ID security group for the researchers, assign the group as eligible for the Contributor role in Privileged Identity Management (PIM) for Azure resources, require MFA during activation, configure a monthly PIM access review for the role assignment, and ensure the emergency access accounts are excluded from the tenant-wide Conditional Access policy that enforces MFA.
The correct configuration utilizes a security group for administrative tasks to minimize overhead. It configures the group assignment in PIM as eligible to guarantee just-in-time access, requires MFA during the activation flow to secure access, and runs monthly access reviews to fulfill compliance requirements. Finally, it excludes emergency access accounts from Conditional Access policies to prevent lockout.

Step-by-Step Solution

1
Define a Microsoft Entra ID security group containing the clinical researchers.
A single administrative unit is created to represent the external researchers.
Assigning roles to groups instead of individual users is an Azure best practice for scalability and lower overhead.
2
Assign the security group as eligible for the required Contributor role in PIM for Azure resources.
Researchers do not have standing privileges and must request activation when they need to work.
This implements the principle of least privilege through just-in-time (JIT) access governance.
3
Configure the PIM role activation settings to require MFA and set up a monthly PIM access review.
Users are verified via MFA during JIT activation, and their eligibility is re-evaluated automatically on a monthly schedule.
This secures the JIT activation flow and meets compliance requirements by automating access reviews.
4
Exclude the emergency access (break-glass) accounts from tenant-wide Conditional Access policies that enforce MFA.
Emergency accounts can still sign in during an MFA service disruption.
Excluding emergency accounts from strict Conditional Access policies prevents tenant lockout during system failures.

Key Concept

Designing privileged access governance using Microsoft Entra Privileged Identity Management (PIM), group-based RBAC, and emergency account exclusions.
Estimated Time:2m 30s
Rate this question

Topics

Entra ID Governance and Privileged Access