Examkin

Soru

Zorluk: OrtaEntra ID Governance and Privileged Access

An energy utility company is designing an identity governance and privileged access strategy for its production Azure subscription. The subscription contains critical infrastructure resources. The design must meet the following requirements:
- Provide just-in-time (JIT) administrative access for the network operations team.
- Require multi-factor authentication (MFA) and manager approval for JIT role activation.
- Ensure that administrative permissions are governed at a group level rather than assigned to individual accounts.
- Maintain a recovery path using emergency access (break-glass) accounts that can bypass MFA in case of a tenant-wide identity outage.

Which design strategy should you recommend to meet these requirements?

  1. A
    Create a Microsoft Entra ID security group for the operations team, assign this group the required Azure RBAC roles as permanently active, and exclude the emergency access accounts from the Conditional Access MFA policies.
  2. B
    Create individual Microsoft Entra ID user accounts for the operations team, assign each account as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) with MFA and approval required for activation, and exclude the emergency access accounts from the Conditional Access MFA policies.
  3. Create a Microsoft Entra ID security group for the operations team, assign this group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) with MFA and approval required for activation, and exclude the emergency access accounts from the Conditional Access MFA policies.Cevap
  4. D
    Create a Microsoft Entra ID security group for the operations team, assign this group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) with MFA and approval required for activation, and apply the Conditional Access MFA policies to all accounts in the tenant without exclusions.

Cevap

Create a Microsoft Entra ID security group for the operations team, assign this group as eligible for the required Azure RBAC roles in Privileged Identity Management (PIM) with MFA and approval required for activation, and exclude the emergency access accounts from the Conditional Access MFA policies.
The correct strategy leverages group-based assignments for scalable security, uses Privileged Identity Management (PIM) to ensure role assignments are eligible rather than permanently active, and properly excludes emergency accounts from MFA requirements to secure a recovery route during tenant-wide MFA outages.

Adım Adım Çözüm

1
Select the correct identity governance container to minimize management overhead.
Create a Microsoft Entra ID security group rather than assigning permissions to individual users.
Assigning permissions to individual users does not scale and violates administrative governance best practices.
2
Determine the assignment type in Microsoft Entra Privileged Identity Management (PIM).
Configure the group role assignment as 'eligible' instead of 'active'.
Eligible assignments allow the operations team to activate the role only when needed, enforcing the principle of least privilege.
3
Define the requirements for activating the eligible role assignment in PIM.
Require multi-factor authentication (MFA), justification, and manager approval for activation.
This guarantees that administrative activities are audited, justified, and approved prior to access elevation.
4
Configure the Conditional Access policy for emergency scenarios.
Exclude the emergency access (break-glass) accounts from MFA-enforcing Conditional Access policies.
Excluding emergency accounts prevents a lockout scenario if there is a regional or tenant-wide MFA provider outage.

Anahtar Kavram

Combining group-based RBAC assignment, Privileged Identity Management (PIM) eligibility settings, and Conditional Access exclusions for emergency accounts.
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access