Examkin

Question

Difficulty: MediumMicrosoft Entra ID Authentication and Conditional Access

Emberwood Manufacturing is designing a secure identity governance and access control solution for its Microsoft Entra ID tenant.

The company must satisfy the following administrative access requirements:
- Ensure that administrators can activate their privileged roles only when needed, for a maximum duration of 4 hours, and require multi-factor authentication (MFA) during activation.
- Prevent administrative lockout from the tenant in the event of a primary MFA service outage or misconfiguration.

Which two configurations should you include in the security design? (Choose two.)

  1. Exclude dedicated emergency access accounts from all Conditional Access policies that enforce multi-factor authentication.Answer
  2. Configure administrative roles in Microsoft Entra Privileged Identity Management (PIM) as eligible assignments with an activation duration limit.Answer
  3. C
    Enforce multi-factor authentication for all administrative accounts, including emergency access accounts, across all Conditional Access policies.
  4. D
    Configure permanent active assignments in Microsoft Entra Privileged Identity Management (PIM) for all administrative accounts.
  5. E
    Deploy an Active Directory Federation Services (AD FS) infrastructure to manage authentication and federated trust for all tenant administrators.

Answer

Exclude dedicated emergency access accounts from all Conditional Access policies that enforce multi-factor authentication, and configure administrative roles in Microsoft Entra Privileged Identity Management (PIM) as eligible assignments with an activation duration limit.
Excluding emergency access accounts from MFA requirements ensures that administrators can still log in to recover the tenant in the event of an MFA service failure. Configuring administrative roles as eligible assignments in Privileged Identity Management (PIM) enforces just-in-time access controls with a strict duration limit and MFA activation requirement.

Step-by-Step Solution

1
Evaluate the requirement to prevent administrative lockout during MFA outages.
Determine that emergency access accounts must be created and explicitly excluded from all MFA-enforcing Conditional Access policies.
If all accounts are subject to MFA, a service outage will prevent any administrator from logging in to fix tenant configurations.
2
Evaluate the requirement to limit administrative role activation to 4 hours with MFA validation.
Select Microsoft Entra Privileged Identity Management (PIM) and configure roles as eligible assignments.
PIM eligible assignments enforce just-in-time access where the administrator must activate the role, perform MFA, and be bound by the maximum activation duration setting.

Key Concept

Designing secure administrative access using Microsoft Entra Privileged Identity Management (PIM) and emergency access account exclusions in Conditional Access policies.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access