Examkin

Question

Difficulty: Very hardEntra ID Governance and Privileged Access

Your organization is designing an identity governance and privileged access strategy for a newly acquired Azure tenant that hosts critical financial workloads. You must implement administrative access for a cloud engineering team according to the following requirements:

- Members of the cloud engineering team must be able to request Subscription Owner permissions on demand for a maximum duration of 4 hours, subject to manager approval.
- Administrative permissions must be managed at a group level rather than assigned to individual user accounts to minimize management overhead and ensure scalable governance.
- Multi-Factor Authentication (MFA) must be enforced for all administrative sessions.
- An emergency access account (break-glass account) must be protected from accidental lockouts that could be caused by MFA service disruptions or configuration issues.

Which two configurations should you recommend to meet these requirements?

  1. Create a Microsoft Entra security group, assign the group to the Owner role of the production subscription, and configure the cloud engineers as eligible members of the group using PIM for Groups.Answer
  2. Create a Conditional Access policy enforcing Multi-Factor Authentication (MFA) for administrative applications, and exclude the emergency access glass-breaker account from this policy.Answer
  3. C
    Assign the Subscription Owner role directly to each cloud engineer's individual user account in Microsoft Entra PIM, and configure individual eligibility settings.
  4. D
    Configure PIM role assignments for the cloud engineers as active with a permanent duration, and use Microsoft Entra ID Access Reviews to review their access quarterly.
  5. E
    Configure a Conditional Access policy that requires MFA for all directory accounts, including the emergency access glass-breaker account, without any exclusions to enforce maximum security.

Answer

Create a Microsoft Entra security group, assign the group to the Owner role of the production subscription, and configure the cloud engineers as eligible members of the group using PIM for Groups; and create a Conditional Access policy enforcing Multi-Factor Authentication (MFA) for administrative applications, and exclude the emergency access glass-breaker account from this policy.
The correct configurations involve using PIM for Groups to assign the Subscription Owner role to a security group and making the engineers eligible members. This complies with group-based governance and allows just-in-time 4-hour access. Additionally, enforcing MFA for administrative sessions while excluding the emergency access account ensures security compliance without risking a tenant lockout scenario.

Step-by-Step Solution

1
Evaluate the requirement for group-based administrative access management.
Identify that assigning roles directly to individual users is not scalable. Decide to use a security group and leverage PIM for Groups to manage eligibility.
This meets the governance requirement of group-level permission management instead of direct user assignment.
2
Address the just-in-time (JIT) on-demand access requirement for the Subscription Owner role.
Assign the security group to the Subscription Owner role, and configure group membership in PIM as eligible with a maximum activation duration of 4 hours and approval requirements.
This ensures engineers only obtain owner permissions when requested and approved, conforming to the principle of least privilege.
3
Determine how to enforce MFA for administrative sessions while securing the emergency account.
Create a Conditional Access policy requiring MFA for administrative roles/apps, but explicitly add the emergency glass-breaker account as an exclusion.
This guarantees that all normal admin sessions require MFA, while safeguarding the tenant against lockout if MFA services fail.

Key Concept

Microsoft Entra Privileged Identity Management (PIM) and security group governance, combined with Conditional Access policy design for emergency accounts.
Estimated Time:3m 0s
Rate this question

Topics

Entra ID Governance and Privileged Access