Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

A biotechnology company is designing an identity governance and privileged access strategy for its Azure environment.

The company has the following requirements:
- A team of five external data scientists must be granted the Virtual Machine Contributor role on a resource group named RG-Research for a duration of six months.
- The external data scientists must only have access when actively performing work, and all access requests must be logged.
- To prevent tenant lockout, the company must maintain two emergency access accounts that are bypassed by standard security controls.
- All administrative role assignments must adhere to the principle of least privilege and scale efficiently without direct user-to-role mappings.

Which two of the following configuration choices should you recommend to meet the requirements? Select TWO.

  1. Create a Microsoft Entra ID security group, add the external data scientists to the group, and assign the group as eligible for the Virtual Machine Contributor role in Microsoft Entra Privileged Identity Management (PIM) at the resource group scope.Answer
  2. Configure two emergency access accounts, and exclude these accounts from all Microsoft Entra Conditional Access policies that enforce Multi-Factor Authentication (MFA).Answer
  3. C
    Assign the Virtual Machine Contributor role directly to each external data scientist's user account as an active assignment in Microsoft Entra Privileged Identity Management (PIM).
  4. D
    Enforce a Conditional Access policy that requires Multi-Factor Authentication (MFA) for all administrative accounts, including the emergency access accounts, to ensure maximum security.

Answer

Create a Microsoft Entra ID security group, add the external data scientists to the group, and assign the group as eligible for the Virtual Machine Contributor role in PIM at the resource group scope. Additionally, configure two emergency access accounts and exclude them from all Conditional Access MFA policies.
The correct architecture requires: (1) using a security group for the external data scientists and configuring it as an eligible assignment in PIM to satisfy scalability and just-in-time (JIT) requirements, and (2) configuring emergency access accounts that are explicitly excluded from MFA policies to prevent lockout during a service disruption.

Step-by-Step Solution

1
Address scalability and JIT access requirements by grouping the external data scientists and using PIM.
By using a Microsoft Entra security group and assigning it to PIM as an eligible assignment, you ensure that access is only activated when needed (JIT) and is managed at the group level rather than directly on individual accounts.
Direct role assignments to users do not scale and are harder to audit, and active assignments bypass PIM's JIT authorization model.
2
Address tenant lockout protection requirements by configuring emergency access accounts.
By excluding the two emergency access accounts from Conditional Access policies enforcing MFA, you ensure administrative access remains possible during MFA service outages.
Failing to exclude emergency accounts from MFA requirements runs the risk of total tenant lockout if the authentication mechanism fails.

Key Concept

Microsoft Entra ID Privileged Identity Management (PIM) and emergency access account administration.
Rate this question

Topics

Entra ID Governance and Privileged Access