Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A software-as-a-service (SaaS) provider is designing a privileged access solution for 10 operations engineers who need temporary, approved Contributor access to a production Azure subscription. The design must enforce the principle of least privilege, require multi-factor authentication (MFA) for role activation, and ensure that access eligibility automatically expires after 180 days. Which of the following identity governance designs should you recommend?

  1. Configure a Microsoft Entra ID security group containing the operations engineers, and assign the group as eligible for the Contributor role in Privileged Identity Management (PIM) with approval and MFA requirements enabled in the PIM role settings.Answer
  2. B
    Assign the Contributor role directly to the individual Entra ID user account of each operations engineer using Azure RBAC, and configure Azure Monitor to track their activity.
  3. C
    Configure a Microsoft Entra ID security group containing the operations engineers, and assign the group as permanently active in the Contributor role in Privileged Identity Management (PIM) to bypass the activation workflow during high-severity incidents.
  4. D
    Configure a Microsoft Entra ID security group containing the operations engineers, assign the group as eligible for the Contributor role in PIM, and configure a Conditional Access policy that requires MFA for all admin interfaces but excludes this group to ensure uninterrupted access.

Answer

Configure a Microsoft Entra ID security group containing the operations engineers, and assign the group as eligible for the Contributor role in Privileged Identity Management (PIM) with approval and MFA requirements enabled in the PIM role settings.
The correct design uses a Microsoft Entra ID security group to aggregate the operations engineers, satisfying the best practice of avoiding direct user assignments. By assigning this group as eligible (not active) for the Contributor role in Privileged Identity Management (PIM), access is kept just-in-time. The requirements for MFA and approval are enforced natively in the PIM role activation settings, and the 180-day limitation is configured via the assignment duration.

Step-by-Step Solution

1
Group creation and member addition
Create a security group in Microsoft Entra ID and add the 10 operations engineers to the group, enabling scalable and consolidated management.
Assigning permissions to a group instead of individual users aligns with Azure identity governance best practices.
2
Configure Privileged Identity Management (PIM) settings
Within PIM for Azure resources, configure the Contributor role settings to require manager approval for activation, require MFA during activation, and enforce a maximum duration.
This establishes just-in-time access constraints that satisfy the business requirements for MFA and approval.
3
Assign the security group to the role in PIM
Assign the security group as eligible for the Contributor role at the subscription scope with a maximum membership duration of 180 days.
This ensures the privileged access is temporary, can be activated only when needed, and automatically expires after the specified period.

Key Concept

Privileged Identity Management (PIM) Eligible Assignments and Group-Based Governance
Estimated Time:1m 30s
Rate this question

Topics

Entra ID Governance and Privileged Access