Examkin

Question

Difficulty: Very hardEntra ID Governance and Privileged Access

An enterprise organization is planning a secure governance and privileged access strategy for their Azure environment. The environment consists of multiple subscriptions under a single management group. The strategy must satisfy the following requirements:

- The operations team requires temporary, time-bound access to manage virtual machines within specific resource groups. The access must be requested, require multi-factor authentication (MFA) during activation, and require approval from the operations manager.
- A security compliance audit of all privileged roles must be performed quarterly. If an administrator fails to complete their review of a user's role assignment within the review window, that user's access must be automatically revoked.
- To guard against tenant lockout during a major identity or MFA provider outage, two emergency-access accounts must be established with administrative access while minimizing the risk of lockout.

Which two configurations should you include in the design to meet the requirements?

  1. Configure a security group containing the operations team members, assign the group as eligible for the Virtual Machine Contributor role in Microsoft Entra Privileged Identity Management (PIM), and configure PIM settings to require MFA and approval for activation.Answer
  2. Configure Microsoft Entra Access Reviews for the privileged roles, set the recurrence to quarterly, and configure the settings to automatically apply results and remove access if reviewers do not respond.Answer
  3. C
    Configure active role assignments for each individual operations team member to the Virtual Machine Contributor role with an expiration of 8 hours, and enforce MFA via a standard Conditional Access policy.
  4. D
    Assign the Virtual Machine Contributor role directly to each individual operations team member's account at the resource group scope, and require MFA through a resource-group-level policy.
  5. E
    Create a Conditional Access policy that enforces MFA for all administrative directory roles, ensuring that the emergency-access accounts are included in the policy scope without any exclusions.

Answer

The correct configurations are to configure a security group with eligible assignments in PIM requiring MFA and approval, and to configure quarterly Access Reviews that automatically remove access on non-response.
The solution requires implementing a secure, scalable governance model. Eligible role assignments in PIM for a security group enforce just-in-time access, requiring MFA and approval for activation. Quarterly Access Reviews with the auto-apply configuration set to remove access on non-response ensure automated compliance enforcement. Lastly, emergency-access accounts must be excluded from MFA policies to prevent lockout.

Step-by-Step Solution

1
Analyze privileged access requirements for the operations team.
Determine that just-in-time access via PIM using group-based eligible assignments is the optimal way to provide temporary, audited access with approval workflows.
Using group-based eligible assignments in PIM reduces administrative overhead and aligns with the principle of least privilege.
2
Address the requirement for automatic revocation during access reviews.
Identify Microsoft Entra Access Reviews as the tool to schedule quarterly audits, configuring the non-response behavior to automatically remove access.
This satisfies the governance requirement to revoke access when reviewers fail to respond to the audit.
3
Evaluate the configuration of emergency-access accounts.
Recognize that emergency-access accounts must be excluded from Conditional Access policies requiring MFA to prevent lockout during MFA outages.
Ensures continuity of administrative access under disaster recovery scenarios.

Key Concept

Microsoft Entra ID Governance and PIM design including JIT access, Access Reviews, and emergency account configuration.
Rate this question

Topics

Entra ID Governance and Privileged Access