Examkin

Question

Difficulty: MediumAzure RBAC and Subscription Governance

An enterprise is designing a subscription governance strategy for a multi-region deployment. The compliance team requires that database administrators are only allowed to manage database resources in the 'DB-Prod-RG' resource group. Additionally, the database administrators should only receive these privileges when actively performing maintenance tasks, and all permissions must be audit-compliant and managed centrally to reduce administrative overhead.

Which two configurations should you include in the design to meet these requirements?

  1. Create a Microsoft Entra ID security group containing the database administrator user accounts, and assign roles to the group instead of individual users.Answer
  2. Configure Microsoft Entra Privileged Identity Management (PIM) to make the security group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.Answer
  3. C
    Assign the SQL DB Contributor role directly to the individual database administrator user accounts at the 'DB-Prod-RG' resource group scope.
  4. D
    Configure Microsoft Entra Privileged Identity Management (PIM) to make the security group permanently active in the SQL DB Contributor role at the subscription scope.

Answer

The correct configurations are to create a Microsoft Entra ID security group containing the database administrator user accounts, and configure Microsoft Entra Privileged Identity Management (PIM) to make the group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.
Assigning roles to a Microsoft Entra security group reduces administrative overhead and ensures governance scales effectively. Using Microsoft Entra Privileged Identity Management (PIM) with an eligible role assignment at the resource group scope enables database administrators to request just-in-time (JIT) access specifically for database maintenance tasks, adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the governance requirements for delegation, scope, and just-in-time access.
Database administrators need access restricted to the 'DB-Prod-RG' resource group, active only during maintenance, with low administrative overhead.
This defines the target scope, role assignment type, and group management strategy.
2
Apply identity governance best practices for administrative scale.
Create a Microsoft Entra security group for the database administrators to avoid direct role assignments to individual users.
Direct assignments to user accounts violate best practices and increase administrative complexity.
3
Configure the role assignment method and scope.
Configure Microsoft Entra Privileged Identity Management (PIM) with an eligible assignment for the group at the resource group scope.
An eligible assignment ensures just-in-time (JIT) activation for maintenance, while the resource group scope restricts access to the specified database resources.

Key Concept

Azure RBAC and Subscription Governance
Rate this question

Topics

Azure RBAC and Subscription Governance