Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A hospitality management company is designing a privileged access strategy for managing its production Azure subscriptions. The company has 50 database administrators who need temporary, approved access to the User Access Administrator role to modify resource permissions during database migrations. The access must be limited to a maximum of 4 hours, require multi-factor authentication (MFA) upon activation, and require manual approval. To minimize administrative overhead, the security team wants to avoid managing individual role assignments in Privileged Identity Management (PIM). Which configuration should you recommend?

  1. A
    Assign the database administrators as eligible for the User Access Administrator role individually in Privileged Identity Management (PIM), and configure the assignments to be permanently active.
  2. B
    Assign the User Access Administrator role directly to each individual database administrator account in the subscription Access Control (IAM) settings.
  3. Create a security group containing the database administrators, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM) for Azure resources.Answer
  4. D
    Configure a Conditional Access policy that enforces multi-factor authentication (MFA) for administrative roles, and exclude the database administrator accounts from the policy.

Answer

Create a security group containing the database administrators, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM) for Azure resources.
Creating a security group containing the database administrators and assigning it to the User Access Administrator role in Privileged Identity Management (PIM) allows the security team to manage eligibility at the group level. This reduces administrative overhead while ensuring that the administrators can still request time-bound, approved access on demand.

Step-by-Step Solution

1
Identify the requirement to minimize administrative overhead for managing 50 database administrators.
Determine that assigning roles to a group is more scalable than managing 50 individual user assignments.
Managing group membership simplifies administration and avoids creating 50 separate PIM assignments.
2
Analyze the access control constraints: temporary access, maximum of 4 hours, requiring MFA, and manual approval.
Determine that Privileged Identity Management (PIM) for Azure resources provides the necessary Just-In-Time (JIT) access control capabilities.
PIM allows users to activate eligible role assignments temporarily after fulfilling activation requirements like MFA and approvals.
3
Combine group-based management with PIM configuration to formulate the final recommendation.
Recommend creating a security group for the administrators and making that group eligible for the User Access Administrator role in PIM.
This satisfies the requirement for group-based administration and temporary, approved, and audited privilege escalation.

Key Concept

Implementing group-based eligibility in Entra ID Privileged Identity Management (PIM) to achieve scalable, time-bound, and approved access governance.
Rate this question

Topics

Entra ID Governance and Privileged Access