An enterprise is onboarding an external vendor to perform temporary maintenance on Azure Virtual Machines located in a production resource group. The maintenance window is 30 days. The design must enforce the principle of least privilege, require multi-factor authentication (MFA) and manager approval before accessing the resources, and automatically clean up access after the maintenance period. Which two configurations should you include in the identity governance and privileged access design?
- Create a Microsoft Entra ID security group for the vendor accounts, and configure the group as eligible for the Virtual Machine Contributor role at the resource group level in Privileged Identity Management (PIM).Cevap
- Configure PIM role settings for the Virtual Machine Contributor role to require MFA and approval upon activation, and set the assignment duration to expire after 30 days.Cevap
- CAssign the Virtual Machine Contributor role directly to each vendor user account at the resource group level.
- DConfigure a permanently active role assignment in PIM for the vendor group to ensure access is always available without delay.
Cevap
Configure group eligibility for the Virtual Machine Contributor role using PIM, and configure PIM settings to require MFA, manager approval, and an eligibility duration of 30 days.
The correct architecture uses group-based role assignments in Entra ID to simplify management. By configuring the group as eligible in Privileged Identity Management (PIM), the vendor accounts do not hold permanent administrative privileges. Activating the role requires MFA and approval as configured in the role settings, and setting an eligibility lifetime of 30 days ensures access is automatically revoked.
Adım Adım Çözüm
Anahtar Kavram
Applying Entra ID Privileged Identity Management (PIM) with group-based RBAC to enforce temporary, approved, and authenticated just-in-time administrative access.