Examkin

Question

Difficulty: MediumEntra ID Governance and Privileged Access

An enterprise is planning the deployment of an Azure landing zone. A team of fifteen external database consultants requires temporary administrative control over the resources in a production subscription to perform database schema updates. Security policy mandates that:

* Access must be granted on a temporary, just-in-time (JIT) basis.
* The administrative privilege must not exceed four hours per activation.
* All activation requests must be approved by an internal security lead.
* To maintain clean subscription-level access controls, privileges should not be assigned directly to individual consultant user accounts.

Which two configurations should you include in the privileged access and identity governance design? (Select TWO.)

  1. Configure the subscription Owner role settings in Microsoft Entra Privileged Identity Management (PIM) to require approval and set the maximum activation duration to four hours.Answer
  2. Assign eligibility for the subscription Owner role to a Microsoft Entra ID security group containing the external consultants' accounts.Answer
  3. C
    Assign the external consultants' user accounts directly as eligible for the Owner role in Microsoft Entra Privileged Identity Management (PIM).
  4. D
    Configure active permanent assignments to the subscription Owner role for the consultants and schedule access reviews to run every four hours.

Answer

To meet the requirements, configure the subscription Owner role settings in Privileged Identity Management to require approval and a maximum activation duration of four hours, and assign the eligibility for the Owner role to a Microsoft Entra ID security group containing the external consultants.
Configuring the role settings in Microsoft Entra Privileged Identity Management (PIM) ensures that the activation duration is capped at four hours and requires approval. Assigning this eligibility to a security group rather than individual users prevents administrative overhead and respects the organization's governance rules.

Step-by-Step Solution

1
Create a security group in Microsoft Entra ID and add the external consultants as members.
Consultant accounts are grouped together, allowing group-based assignment.
This avoids assigning roles directly to individual user accounts, meeting the governance requirements.
2
Configure the subscription Owner role settings in Privileged Identity Management (PIM) for Azure resources.
The role settings are modified to require approval and limit activation duration to four hours.
This enforces the required approval workflow and maximum duration constraints during activation.
3
Assign the Microsoft Entra ID security group as eligible for the Owner role in PIM for Azure resources.
Group members can now request activation of the Owner role when needed.
This implements the just-in-time (JIT) access model for the consultants.

Key Concept

Using group-based eligibility and role settings in Privileged Identity Management (PIM) to secure administrative access.
Rate this question

Topics

Entra ID Governance and Privileged Access