You are designing an identity governance solution for a company's Azure environment. You need to grant support staff temporary, time-bound access to administrative roles. The solution must prevent permanent standing access and follow administrative best practices for identity delegation. Which configuration should you recommend?
- Configure eligible role assignments for a Microsoft Entra security group containing the support staff.Answer
- BConfigure active role assignments for the individual support staff user accounts in Microsoft Entra Privileged Identity Management (PIM).
- CAssign the administrative roles directly to the individual support staff user accounts.
- DConfigure eligible role assignments and apply a Conditional Access policy enforcing Multi-Factor Authentication (MFA) that does not exclude the emergency access accounts.
Answer
Configure eligible role assignments for a Microsoft Entra security group containing the support staff.
Configuring eligible role assignments ensures that users do not have standing privileges and must request activation to use the role, which provides just-in-time (JIT) access. Assigning the role to a security group containing the support staff aligns with governance best practices by avoiding direct assignments to individual user accounts.
Step-by-Step Solution
Key Concept
Just-In-Time (JIT) access using Privileged Identity Management (PIM) eligible assignments mapped to security groups.
Estimated Time:1m 0s