Examkin

Question

Difficulty: EasyEntra ID Governance and Privileged Access

A university IT department needs to grant student helpdesk assistants the ability to reset user passwords in Microsoft Entra ID. To minimize security risks and ensure compliance with the principle of least privilege, the students must only have the User Administrator role active when they are on shift and actively resolving tickets.

Which Microsoft Entra Privileged Identity Management (PIM) configuration should you recommend for the student accounts?

  1. A
    Assign the User Administrator role directly to each student's user account as a permanently active assignment to simplify access.
  2. B
    Create a single shared administrator account for the student helpers and exclude it from Microsoft Entra Conditional Access multi-factor authentication (MFA) policies.
  3. Configure the student accounts as eligible for the User Administrator role, requiring them to activate the role when starting a shift.Answer
  4. D
    Assign the User Administrator role to each student helper's personal account individually at the subscription scope rather than using security groups or Privileged Identity Management.

Answer

Configure the student accounts as eligible for the User Administrator role, requiring them to activate the role when starting a shift.
Configuring the student helper accounts as eligible for the User Administrator role requires them to perform an activation process (which can include MFA verification and justification) to gain administrative access. The role automatically deactivates after their shift, fulfilling the requirement for time-bound access and adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the requirement for temporary, time-bound privileged access.
Microsoft Entra Privileged Identity Management (PIM) must be utilized to implement just-in-time role activation.
PIM ensures that administrative privileges are not persistently active on the accounts.
2
Choose between an eligible or active role assignment in PIM.
Select an eligible assignment type rather than active.
Eligible assignments require users to explicitly activate the role only when needed (e.g., during their shift), whereas active assignments grant persistent privileges.

Key Concept

Microsoft Entra ID Privileged Identity Management (PIM) enables just-in-time (JIT) and time-bound role activations. Eligible assignments enforce the principle of least privilege by ensuring permissions are only active when requested and authorized.
Rate this question

Topics

Entra ID Governance and Privileged Access