Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

An organization is designing a privileged access solution for a team of external database administrators who need temporary access to the DocumentDB Database Account Contributor role on a production Cosmos DB account. The solution must minimize administrative overhead, enforce multi-factor authentication (MFA) and justification prior to access activation, and ensure that emergency access accounts are protected from lockout during MFA service outages. Which configuration should you recommend?

  1. A
    Assign the role eligibility directly to each administrator's user account in Privileged Identity Management (PIM) requiring justification and MFA for activation, and exclude emergency access accounts from the Conditional Access policy requiring MFA.
  2. Create a Microsoft Entra ID security group for the administrators, make the group eligible for the role in Privileged Identity Management (PIM) requiring justification and MFA for activation, and exclude emergency access accounts from the Conditional Access policy requiring MFA.Answer
  3. C
    Create a Microsoft Entra ID security group for the administrators, assign the group permanently active status for the role in Privileged Identity Management (PIM) to avoid activation delays, and exclude emergency access accounts from the Conditional Access policy requiring MFA.
  4. D
    Create a Microsoft Entra ID security group for the administrators, make the group eligible for the role in Privileged Identity Management (PIM) requiring justification and MFA for activation, and require MFA for all accounts including emergency access accounts in the Conditional Access policy.

Answer

Create a Microsoft Entra ID security group for the administrators, make the group eligible for the role in Privileged Identity Management (PIM) requiring justification and MFA for activation, and exclude emergency access accounts from the Conditional Access policy requiring MFA.
The correct option addresses all governance requirements by using group-based assignment to minimize management overhead, configuring eligible status in PIM to require JIT activation with justification and MFA, and excluding emergency access accounts from MFA requirements to prevent administrative lockout.

Step-by-Step Solution

1
Select group-based assignment over individual assignment.
Reduced administrative overhead by using a single Microsoft Entra ID security group instead of multiple direct PIM assignments.
Assigning role eligibility to a security group aligns with Azure identity governance best practices.
2
Configure the security group's PIM assignment type as eligible.
Just-in-time (JIT) access is enforced, requiring administrators to explicitly request and justify activation.
Making the assignment eligible rather than permanently active ensures compliance with least privilege.
3
Define Conditional Access and PIM activation settings.
MFA and justification are required for activation, while emergency access accounts are excluded from the MFA requirement.
Excluding break-glass accounts prevents total tenant lockout if the MFA service is unavailable.

Key Concept

Entra ID Privileged Access and Governance
Estimated Time:1m 30s
Rate this question

Topics

Entra ID Governance and Privileged Access