Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A financial services firm is onboarding an external auditing agency to review its Azure subscription resources. The agency has five auditors who need temporary, approved access to the 'Reader' role on a production subscription. The firm's security policy requires:
- Access must be delegated and managed via groups rather than assigning roles directly to individual user accounts.
- Access must be activated on-demand (Just-In-Time) and require approval.
- The firm must also implement a Conditional Access policy to enforce multi-factor authentication (MFA) for all administrative access, but must prevent tenant lockout of their emergency-access accounts.

Which solution should you recommend to meet these requirements?

  1. A
    Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make each individual auditor's user account eligible for the 'Reader' role directly, and configure a Conditional Access policy requiring MFA for administrative access that explicitly excludes the emergency-access accounts.
  2. B
    Create a security group, assign the 'Reader' role to the group, configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors active members of the group permanently, and configure a Conditional Access policy requiring MFA for administrative access that explicitly excludes the emergency-access accounts.
  3. Create a security group, assign the 'Reader' role to the group, configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible for group membership, and configure a Conditional Access policy requiring MFA for administrative access that explicitly excludes the emergency-access accounts.Answer
  4. D
    Create a security group, assign the 'Reader' role to the group, configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible for group membership, and configure a Conditional Access policy requiring MFA for all administrative access without excluding any accounts.

Answer

Create a security group, assign the 'Reader' role to the group, configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible for group membership, and configure a Conditional Access policy requiring MFA for administrative access that explicitly excludes the emergency-access accounts.
The correct solution uses a security group to manage permissions, aligning with Azure RBAC best practices of avoiding individual assignments. By configuring Microsoft Entra Privileged Identity Management (PIM) for Groups, the external auditors can activate their membership in the group on-demand (Just-In-Time), which automatically grants them the 'Reader' role. Additionally, excluding the emergency-access accounts from the administrative multi-factor authentication (MFA) Conditional Access policy follows security best practices to prevent directory lockout.

Step-by-Step Solution

1
Identify the governance mechanism for group-based role delegation.
Determine that assigning Azure RBAC roles to a Microsoft Entra security group satisfies the requirement to manage permissions via groups rather than individual accounts.
Ensures scalable access governance and minimizes administrative overhead.
2
Configure Just-In-Time (JIT) access for group members.
Configure Privileged Identity Management (PIM) for Groups to make the auditors eligible for group membership.
Enables on-demand activation of group membership, which transitively grants the assigned roles only when required.
3
Enforce MFA and protect break-glass accounts.
Create a Conditional Access policy enforcing MFA for administrative roles, and add the emergency-access accounts to the policy's exclusion list.
Ensures secure administrative access while preventing tenant lockout in the event of an identity provider outage.

Key Concept

Implementing group-based Privileged Identity Management (PIM) and safe Conditional Access policies.
Rate this question

Topics

Entra ID Governance and Privileged Access