Examkin

Soru

Zorluk: ZorAzure RBAC and Subscription Governance

Your company is designing a delegated administration model for a team of database administrators (DBAs) who manage resources across multiple Azure subscriptions. The DBAs require temporary, time-bound permissions to manage Azure SQL databases within a specific subset of subscriptions, adhering to the principle of least privilege.

You plan to implement a custom Azure RBAC role and delegate it using Microsoft Entra Privileged Identity Management (PIM) for Groups.

Which sequence of steps should you perform to implement this governance solution?

  1. 1Create a new management group and associate the target subscriptions with it.
  2. 2Create a custom Azure RBAC role with its AssignableScopes set to the resource path of the new management group.
  3. 3Create a role-assignable security group in Microsoft Entra ID.
  4. 4Assign the custom Azure RBAC role to the security group at the scope of the management group.
  5. 5Configure eligible member assignments for the DBAs to the security group in Privileged Identity Management (PIM) for Groups.

Cevap

To implement the delegated administration model, first create the management group to define the scope. Next, create the custom Azure RBAC role and set its assignable scope to that management group. Then, create a role-assignable Microsoft Entra security group. Assign the custom role to the group at the management group scope, and finally, configure eligible member assignments for the DBAs to the group in PIM for Groups.
The correct sequence begins by defining the boundary (creating the management group), which allows for the creation of the custom role referencing that specific scope. A role-assignable group is then created to receive the assignment. The custom role is assigned to the group, and finally, Privileged Identity Management (PIM) for Groups is configured to govern membership of that group dynamically, enforcing JIT access.

Adım Adım Çözüm

1
Create a new management group and move the target subscriptions under it.
A unified scope is established, which provides a resource path for RBAC scopes.
The resource ID of this management group is a prerequisite for configuring the custom role's assignable scopes.
2
Define a custom Azure RBAC role with the management group in its AssignableScopes.
A custom role is created that can be assigned at the management group scope or below.
Azure RBAC requires that custom roles specify the exact scopes at which they can be assigned.
3
Create a role-assignable security group in Microsoft Entra ID.
An Entra security group with the isAssignableToRole property enabled is created.
Only role-assignable groups can be used reliably for Delegated RBAC assignments and onboarding to PIM for Groups.
4
Assign the custom RBAC role to the security group at the management group scope.
The security group is granted permissions to manage Azure SQL databases across all subscriptions in the management group.
This establishes the permission link to the group before group membership is governed via JIT.
5
Configure eligible member assignments for DBAs in PIM for Groups.
DBAs are set up as eligible members who can activate their membership to assume the role temporarily.
This enforces the principle of least privilege by ensuring access is time-bound and approved.

Anahtar Kavram

Azure RBAC scope inheritance, custom role assignable scopes, and Microsoft Entra PIM for Groups governance.
Bu soruyu puanla

Konular

Azure RBAC and Subscription Governance