Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

An organization is designing a privileged access and governance strategy for its Azure tenant. The strategy must enforce Multi-Factor Authentication (MFA) for all administrative roles using Microsoft Entra Privileged Identity Management (PIM) and Conditional Access policies, while ensuring that the organization does not get locked out of the tenant during an Entra ID MFA service outage.

Which of the following configurations should you recommend?

  1. A
    Create a Microsoft Entra security group for the administrators, configure the group with permanently active assignments in PIM to bypass the activation flow, and exclude a dedicated emergency access account from the Conditional Access MFA policy.
  2. B
    Assign eligible PIM administrative roles directly to each user account, configure PIM to require MFA on activation, and exclude a dedicated emergency access account from the Conditional Access MFA policy.
  3. Create a Microsoft Entra security group for the administrators, configure the group as eligible for PIM roles requiring MFA on activation, and exclude a dedicated emergency access account from the Conditional Access MFA policy.Answer
  4. D
    Create a Microsoft Entra security group for the administrators, configure the group as eligible for PIM roles requiring MFA on activation, and apply the Conditional Access MFA policy to all accounts in the tenant without exclusions.

Answer

Create a Microsoft Entra security group for the administrators, configure the group as eligible for PIM roles requiring MFA on activation, and exclude a dedicated emergency access account from the Conditional Access MFA policy.
The correct strategy utilizes Microsoft Entra security groups for scalable role management (addressing RBAC best practices), configures the PIM assignment as eligible to enforce just-in-time (JIT) access, and excludes a dedicated emergency access account from the Conditional Access MFA policy to mitigate tenant lockout risks during an MFA outage.

Step-by-Step Solution

1
Define administrative role assignment strategy using Microsoft Entra security groups.
Ensures role assignments are scalable and manageable by avoiding direct user assignments.
Direct user assignments violate RBAC governance best practices.
2
Configure Microsoft Entra Privileged Identity Management (PIM) eligibility rules.
Enforces just-in-time (JIT) access by marking assignments as eligible rather than permanently active.
Permanently active roles bypass access controls and increase the attack surface.
3
Enforce Multi-Factor Authentication (MFA) via Conditional Access while excluding emergency accounts.
Secures administrative sessions while preventing lockout during MFA outages.
Failing to exclude emergency glass-breaker accounts leaves the tenant vulnerable to total lockout.

Key Concept

Designing privileged access and governance solutions using Entra ID PIM, group-based assignments, and emergency access strategies.
Rate this question

Topics

Entra ID Governance and Privileged Access