Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Meridian Global Logistics is designing an identity security strategy for its hybrid cloud environment. The organization synchronizes its on-premises Active Directory Domain Services (AD DS) directory to Microsoft Entra ID using Password Hash Synchronization (PHS). You need to design an access control solution that meets the following security requirements:
- Enforce Multi-Factor Authentication (MFA) for administrative access to the Azure management portal.
- Ensure that administrators only assume privileged roles when performing administrative tasks, rather than having persistent access.
- Guarantee that emergency access (break-glass) accounts remain functional to prevent tenant lockout during an MFA system outage.

Which of the following designs should you recommend?

  1. A
    Configure Microsoft Entra Privileged Identity Management (PIM) with active assignments for administrative roles, enforce Multi-Factor Authentication (MFA) via a Conditional Access policy targeting administrative apps, and exclude emergency access accounts from the policy.
  2. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for administrative roles, enforce Multi-Factor Authentication (MFA) via a Conditional Access policy targeting administrative apps, and exclude emergency access accounts from the policy.Answer
  3. C
    Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for administrative roles, enforce Multi-Factor Authentication (MFA) via a Conditional Access policy targeting administrative apps, and apply the policy to all administrative accounts without any exclusions.
  4. D
    Deploy Active Directory Federation Services (AD FS) to manage federation and authentication, configure Microsoft Entra Privileged Identity Management (PIM) with active assignments for administrative roles, and exclude emergency access accounts from the MFA policy.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for administrative roles, enforce Multi-Factor Authentication (MFA) via a Conditional Access policy targeting administrative apps, and exclude emergency access accounts from the policy.
The correct design ensures that administrative roles are non-persistent by configuring them as eligible in Microsoft Entra Privileged Identity Management (PIM). It enforces MFA for administrative access using a Conditional Access policy, while excluding break-glass accounts from this policy to prevent administrative lockout during MFA system outages.

Step-by-Step Solution

1
Select Microsoft Entra Privileged Identity Management (PIM) to control administrative role elevation.
Using eligible role assignments ensures that administrative access is just-in-time (JIT) rather than permanent, meeting the requirement for non-persistent access.
This enforces the principle of least privilege and prevents administrators from constantly holding elevated rights.
2
Enforce Multi-Factor Authentication (MFA) via Conditional Access targeting the Microsoft Azure Management cloud app.
All administrative access to the Azure portal requires MFA.
This secures administrative interfaces against credential compromise.
3
Exclude emergency access (break-glass) accounts from the Conditional Access policy.
Emergency access accounts can authenticate without triggering MFA requirements.
This guarantees that administrators can still access the tenant in the event of an MFA service outage.

Key Concept

Microsoft Entra ID Authentication and Conditional Access
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access