Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

An enterprise is designing a secure identity governance and privileged access strategy for its Azure infrastructure. The solution must meet the following requirements:

* A team of 10 system administrators must be granted administrative privileges on Azure subscription resources only when performing specific maintenance windows, requiring justification and multi-factor authentication (MFA).
* Administrative permissions must be managed at scale, avoiding direct role assignments to individual users.
* A backup mechanism must be established to ensure administrative access to the tenant remains possible even if the primary authentication systems or Conditional Access policies fail, preventing tenant lockout.

Which two configuration steps should you include in the design? (Select two.)

  1. Create a Microsoft Entra ID security group containing the system administrators and configure the group as eligible for the target Azure RBAC roles in Privileged Identity Management (PIM).Answer
  2. Create two emergency access accounts with the Global Administrator role and exclude them from all Conditional Access policies.Answer
  3. C
    Assign the target Azure RBAC roles directly to each of the 10 individual administrator user accounts as eligible in Privileged Identity Management (PIM).
  4. D
    Configure the system administrators' group with permanently active assignments for the target Azure RBAC roles in Privileged Identity Management (PIM).
  5. E
    Configure the emergency access accounts to be subject to all Conditional Access policies that enforce multi-factor authentication (MFA).

Answer

To satisfy the governance requirements, you must create a Microsoft Entra ID security group containing the system administrators and configure the group as eligible for the target Azure RBAC roles in Privileged Identity Management (PIM), and create two emergency access accounts with the Global Administrator role while excluding them from all Conditional Access policies.
The correct options involve creating a Microsoft Entra ID security group for the administrators and making it eligible in PIM, which ensures that role elevations are requested only when needed (JIT) and are managed collectively rather than individually. Furthermore, configuring emergency access accounts with the Global Administrator role and excluding them from Conditional Access policies guarantees that the tenant remains accessible during disasters without risk of MFA-induced lockouts.

Step-by-Step Solution

1
Analyze the requirements for group management and JIT access.
Determine that administrators should not be assigned roles individually and must use PIM eligibility.
Aligns with Microsoft Entra best practices for scalable governance and JIT elevation.
2
Establish the group role assignment strategy.
Create a security group, add the 10 administrators to it, and assign the group as eligible for the desired Azure roles in PIM.
Allows administrators to activate their role only when needed, requiring MFA and justification, without individual user role maintenance.
3
Formulate a break-glass disaster recovery plan.
Create two emergency access accounts assigned the Global Administrator role, and exclude them from all Conditional Access policies.
Ensures that administrative access is possible in emergency scenarios, preventing lockout.

Key Concept

Microsoft Entra ID Privileged Identity Management (PIM) and emergency access account governance.
Rate this question

Topics

Entra ID Governance and Privileged Access