Examkin

Question

Difficulty: Very hardEntra ID Governance and Privileged Access

A multinational healthcare organization requires external vendor consultants to manage specific Azure resource groups containing protected health information (PHI) across multiple subscriptions. You are designing a privileged access solution that meets the following security requirements:
- Vendor consultants must only receive administrative permissions on-demand.
- Permission activation must require multi-factor authentication (MFA) and manager approval.
- The solution must minimize administrative overhead and scale as vendor personnel change.
- A strict tenant-wide Conditional Access policy must enforce MFA for all administrative roles, while ensuring that the organization's emergency access accounts are never locked out under any circumstance.

Which design strategy should you recommend to meet these requirements?

  1. A
    Assign each individual vendor consultant's user account as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.
  2. B
    Create a Microsoft Entra security group, assign the group as active for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.
  3. Create a Microsoft Entra security group, assign the group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.Answer
  4. D
    Create a Microsoft Entra security group, assign the group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and apply the administrative MFA Conditional Access policy to all administrative accounts without exclusions.

Answer

Create a Microsoft Entra security group, assign the group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) for Azure resources, and exclude the emergency access accounts from the administrative MFA Conditional Access policy.
The correct design uses a Microsoft Entra security group to manage the vendor accounts collectively, minimizing administrative overhead. By assigning the group as eligible in PIM for Azure resources, vendor consultants only obtain administrative access on-demand (just-in-time) after meeting the activation requirements such as MFA and approval. Excluding break-glass/emergency access accounts from the tenant-wide Conditional Access MFA policy ensures the tenant remains accessible in emergency situations while enforcing MFA for all other administrative access.

Step-by-Step Solution

1
Select the appropriate identity container for vendor administration.
A Microsoft Entra security group is defined to contain all external vendor consultant accounts.
Using a security group instead of individual accounts reduces administrative overhead and aligns with scalable governance practices.
2
Configure the access assignment type in Privileged Identity Management (PIM).
The security group is assigned to the required Azure RBAC roles in PIM as eligible rather than active.
An eligible assignment enforces just-in-time (JIT) administrative access, ensuring that permissions are only granted on-demand and are not permanently active.
3
Apply Conditional Access policy settings for administrative MFA.
A Conditional Access policy is designed to require MFA for administrative roles during role activation and session initiation.
This enforces strong authentication for privileged actions in compliance with security guidelines.
4
Secure emergency glass-breaker accounts from policy enforcement.
The organization's emergency access accounts are explicitly excluded from the MFA Conditional Access policy.
Excluding break-glass accounts ensures that administrators can access the tenant to resolve issues in the event of an MFA service disruption.

Key Concept

Designing scalable, just-in-time privileged access using Entra ID PIM group assignments and securing administrative sessions with Conditional Access while preventing tenant lockout.
Rate this question

Topics

Entra ID Governance and Privileged Access