Examkin

Question

Difficulty: HardEntra ID Governance and Privileged Access

An enterprise organization is designing a privileged access solution for Microsoft Entra ID. The solution must secure administrative access to the User Administrator role. The design must ensure that administrators only have access when needed, direct assignment of roles to individual user accounts is avoided, and activation requires approval. In the event of an identity service disruption, emergency break-glass accounts must remain functional and not be locked out. Which two of the following configuration steps should you include in the design?

  1. Create a Microsoft Entra role-assignable group, assign the User Administrator role to the group, and configure Privileged Identity Management (PIM) for Groups to make administrators eligible for group membership.Answer
  2. Configure Privileged Identity Management (PIM) activation settings for the User Administrator role to require Multi-Factor Authentication (MFA) and designate a specific approver group.Answer
  3. C
    Assign the User Administrator role directly to each administrator's account as a permanently active assignment to guarantee administrative coverage.
  4. D
    Apply a tenant-wide Conditional Access policy requiring MFA for all administrative roles to all accounts, ensuring no users are excluded.

Answer

To meet the requirements, the design must use a Microsoft Entra role-assignable group combined with Privileged Identity Management (PIM) for Groups to manage eligibility dynamically, and configure PIM settings for the User Administrator role to require MFA and administrative approval.
The correct architecture uses Microsoft Entra role-assignable groups managed via PIM for Groups to avoid assigning privileges directly to individual user accounts. Simultaneously, configuring PIM activation policies for the role ensures that any eligible member who tries to activate the role must complete multi-factor authentication and receive approval from the designated group before access is provisioned.

Step-by-Step Solution

1
Evaluate the requirement for avoiding direct individual role assignments.
Identify that assigning roles to a role-assignable group managed via PIM for Groups is the recommended approach for scalable administration.
Direct role assignments to individual user accounts increase administrative overhead and are harder to audit.
2
Evaluate the requirement for just-in-time access verification and approval.
Identify that configuring PIM settings for the role is the standard way to enforce MFA and approval flows on activation.
PIM role settings manage the lifecycle and verification requirements of role activation.
3
Analyze the impact on emergency access accounts.
Identify that emergency accounts must be excluded from policies that enforce MFA blockages to prevent lockout.
Exclusions are critical to ensure that break-glass accounts remain functional during identity failures.

Key Concept

Privileged access governance and just-in-time role activation using Microsoft Entra PIM and role-assignable groups.
Estimated Time:2m 0s
Rate this question

Topics

Entra ID Governance and Privileged Access