Examkin

Question

Difficulty: HardMicrosoft Entra ID Authentication and Conditional Access

Vortex Quantum Systems is designing an identity and access governance solution for its Microsoft Entra ID tenant. The design must satisfy the following security requirements:
- All administrators must be prompted for multi-factor authentication (MFA) when accessing administrative portals.
- Members of the Global Administrator role must activate their role on-demand, and role activation must require MFA.
- The design must prevent administrative lockout in the event of an Azure MFA service outage.

Which two configurations should you include in the design to meet these requirements?

  1. In Microsoft Entra Privileged Identity Management (PIM), configure the Global Administrator role to require MFA for activation and assign administrators as eligible.Answer
  2. Configure a Conditional Access policy requiring MFA for all administrative roles, and exclude a dedicated, cloud-only emergency access account from the policy.Answer
  3. C
    Configure a Conditional Access policy requiring MFA for all administrative roles, applying it to all administrative accounts without any exclusion groups.
  4. D
    In Microsoft Entra Privileged Identity Management (PIM), configure the Global Administrator role assignments as active to ensure immediate access without activation delay.

Answer

Configuring the Global Administrator role as eligible in Privileged Identity Management (PIM) with MFA required for activation, and configuring a Conditional Access policy requiring MFA for administrative roles while excluding a dedicated cloud-only emergency access account.
The requirements are met by configuring the Global Administrator role in Microsoft Entra Privileged Identity Management (PIM) as eligible, which enforces on-demand, just-in-time activation with MFA. Additionally, creating a Conditional Access policy requiring MFA for administrative roles while excluding a cloud-only emergency access account secures administrative portals while preventing total tenant lockout during an MFA outage.

Step-by-Step Solution

1
Analyze the requirement for on-demand administrator role activation with MFA.
Determine that Microsoft Entra Privileged Identity Management (PIM) is required, and role assignments must be configured as eligible (not active) with MFA enabled for activation to enforce just-in-time access.
Active assignments grant permanent access, violating the on-demand requirement.
2
Analyze the requirement to enforce MFA for all administrative access while preventing lockout during an MFA outage.
Determine that a Conditional Access policy must target administrative roles with MFA requirements, but must exclude a dedicated cloud-only emergency access (glass-breaker) account.
Omitting the emergency account from the exclusion list runs the risk of permanent lockout if MFA services become unavailable.

Key Concept

Enforcing secure administrative access using Microsoft Entra Privileged Identity Management (PIM) and Conditional Access policies with emergency exclusion accounts.
Rate this question

Topics

Microsoft Entra ID Authentication and Conditional Access