Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

An online gaming platform is designing a privileged access and governance strategy for its Azure infrastructure. The platform has the following requirements:

* Operations engineers must have administrative access to production database resources only when performing scheduled maintenance tasks.
* Two dedicated emergency access (break-glass) accounts must be able to access the environment even during a multi-factor authentication (MFA) service outage.

Which of the following configurations should you recommend to meet these requirements?

  1. Add the operations engineers to a Microsoft Entra ID group and configure the group with an eligible role assignment in Privileged Identity Management (PIM). Exclude the emergency access accounts from the Conditional Access policy that enforces MFA.Answer
  2. B
    Configure each operations engineer's individual user account with an eligible role assignment in Privileged Identity Management (PIM). Exclude the emergency access accounts from the Conditional Access policy that enforces MFA.
  3. C
    Add the operations engineers to a Microsoft Entra ID group and configure the group with a permanently active role assignment in Privileged Identity Management (PIM). Exclude the emergency access accounts from the Conditional Access policy that enforces MFA.
  4. D
    Add the operations engineers to a Microsoft Entra ID group and configure the group with an eligible role assignment in Privileged Identity Management (PIM). Apply the Conditional Access policy that enforces MFA to all administrative accounts, including the emergency access accounts.

Answer

Add the operations engineers to a Microsoft Entra ID group and configure the group with an eligible role assignment in Privileged Identity Management (PIM), while excluding the emergency access accounts from the Conditional Access policy that enforces MFA.
The correct recommendation uses a Microsoft Entra ID security group to simplify role administration and makes the group eligible for the role in Privileged Identity Management (PIM) to support just-in-time access. In addition, it explicitly excludes the emergency access accounts from MFA enforcement in Conditional Access to ensure the tenant remains accessible during an MFA service outage.

Step-by-Step Solution

1
Evaluate access requirements for operations engineers
Identify that operations engineers need temporary, just-in-time access, which requires an eligible role assignment in Privileged Identity Management (PIM).
This minimizes standing administrative privileges in accordance with the principle of least privilege.
2
Apply scalable administration guidelines
Assign the role to a Microsoft Entra ID security group rather than directly to individual users.
This avoids administrative overhead and keeps access control scalable.
3
Design emergency access resilience
Exclude emergency access (break-glass) accounts from the Conditional Access policies that enforce MFA.
This prevents administrative lockout in the event of an MFA service outage.

Key Concept

Privileged Identity Management (PIM) group-based eligibility and emergency account management in Entra ID Governance
Rate this question

Topics

Entra ID Governance and Privileged Access