Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

Your enterprise has a management group hierarchy. You need to design a governance solution that delegates the ability to manage Azure resource locks across all subscriptions under a specific management group to an operations team. The solution must meet the following requirements:

* Ensure operations team members can only manage locks during authorized maintenance windows.
* Minimize administrative overhead as members of the operations team change.
* Follow the principle of least privilege.

Which two configurations should you include in the design?

  1. Create a Microsoft Entra ID security group that contains the operations team members.Answer
  2. Configure an eligible role assignment for the security group at the management group scope using Microsoft Entra Privileged Identity Management (PIM) for Azure resources.Answer
  3. C
    Assign the custom role directly to each individual operations team member's user account at the management group scope.
  4. D
    Configure a permanently active role assignment for the security group at the management group scope.
  5. E
    Deploy an Azure Policy with a Deny effect at the management group scope to prevent any user from deleting resource locks.

Answer

To meet the requirements, you should create a Microsoft Entra ID security group containing the operations team members, and configure an eligible role assignment for this security group at the management group scope using Microsoft Entra Privileged Identity Management (PIM) for Azure resources.
Creating a Microsoft Entra ID security group minimizes administrative overhead because you can manage team membership without updating role assignments. Configuring an eligible role assignment via Microsoft Entra Privileged Identity Management (PIM) for Azure resources ensures that the group members only obtain the required permissions during maintenance windows (just-in-time access) rather than having permanent privileges, adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the requirement to minimize administrative overhead for team membership changes.
Determine that permissions must be assigned to a Microsoft Entra ID group rather than individual user accounts.
Using groups allows team membership to be managed dynamically without modifying the underlying role assignments.
2
Identify the requirement for time-bound access during authorized maintenance windows.
Determine that Privileged Identity Management (PIM) must be used to provide just-in-time (JIT) access, specifying eligible assignments rather than permanently active assignments.
Eligible assignments require users to explicitly activate their role, limiting exposure and enforcing the principle of least privilege.
3
Select the correct combination of options representing these two design decisions.
Select the option to create a security group and the option to configure an eligible assignment using PIM for Azure resources.
Combining group-based assignments with PIM eligible roles satisfies all design constraints.

Key Concept

Delegating administrative privileges using Microsoft Entra ID groups and just-in-time access via Privileged Identity Management (PIM) at the management group scope.
Rate this question

Topics

Azure RBAC and Subscription Governance