Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An organization is designing a subscription governance model to allow network security administrators to manage network security rules across multiple subscriptions. To follow the principle of least privilege, the administrators must only be able to elevate their access on-demand using Just-In-Time (JIT) access. You need to configure this administrative model. In which order should you perform the configuration steps?

  1. 1Create a parent Management Group and move the target subscriptions into it.
  2. 2Create a custom Azure RBAC role with the required network security permissions, specifying the new Management Group in the AssignableScopes property.
  3. 3Create a Microsoft Entra ID security group.
  4. 4Assign the custom Azure RBAC role to the Microsoft Entra ID security group at the parent Management Group scope.
  5. 5Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the administrators eligible for the security group.

Answer

To implement this design, first create a parent Management Group and associate the subscriptions. Next, create a custom Azure RBAC role with the required permissions and set its assignable scope to the Management Group. Then, create a Microsoft Entra ID security group and assign the custom role to it at the Management Group scope. Finally, configure PIM for Groups to make users eligible for the security group, enabling JIT access.
Establishing the Management Group first provides the container needed for scope inheritance and is required before configuring custom roles targeting that scope. The custom role must specify the Management Group in its assignable scopes. The security group must be created next so that the custom role can be assigned to it. Assigning the custom role to the group at the Management Group scope ensures the permissions are inherited by all child subscriptions. Finally, configuring PIM for Groups enables Just-In-Time membership, fulfilling the requirement for JIT administrative access.

Step-by-Step Solution

1
Establish the management scope.
A new parent Management Group containing the target subscriptions is created.
This establishes the scope hierarchy and allows governance controls to inherit downward.
2
Define the custom Azure RBAC role.
A custom role definition is registered with the parent Management Group in its AssignableScopes.
Custom roles must define where they can be assigned. The Management Group must exist before it can be referenced in the role definition's assignable scopes.
3
Deploy a Microsoft Entra security group.
A security group exists to hold the network administrators.
Group-based role assignment is a best practice that simplifies PIM integration and minimizes individual role assignments.
4
Bind the custom role to the security group.
The security group is assigned the custom role at the parent Management Group scope.
This configuration ensures that any active member of the security group inherits the custom role permissions across all subscriptions in the Management Group.
5
Enable Privileged Identity Management for the security group.
Administrator accounts are made eligible for the security group in PIM.
This enables Just-In-Time (JIT) membership elevation, satisfying the least privilege and on-demand requirements.

Key Concept

Group-based Azure RBAC scope inheritance combined with Microsoft Entra PIM for Groups to achieve Just-In-Time least privilege management.
Rate this question

Topics

Azure RBAC and Subscription Governance