Examkin

Soru

Zorluk: OrtaEntra ID Governance and Privileged Access

An enterprise is designing an identity governance and privileged access strategy for its Azure subscription. The subscription contains critical production workloads. The solution must meet the following requirements:
- A group of external compliance auditors needs read-only access to all subscription resources for a temporary period of three weeks.
- A group of internal security administrators needs to manage Azure role assignments, but only when actively conducting access reviews.
- Administrative overhead must be minimized, and the principle of least privilege must be strictly followed.

Which of the following actions should you include in the design? (Select TWO.)

  1. Create a Microsoft Entra security group for the external auditors, and configure an eligible Reader role assignment for the group using Privileged Identity Management (PIM).Cevap
  2. Create a Microsoft Entra security group for the internal security administrators, and configure an eligible User Access Administrator role assignment for the group using Privileged Identity Management (PIM).Cevap
  3. C
    Assign the Reader role directly to each external auditor's individual user account with a permanent active assignment.
  4. D
    Configure the User Access Administrator role assignments as active and permanent in Privileged Identity Management (PIM) for the internal security administrators' individual user accounts.

Cevap

To meet the requirements, you should create Microsoft Entra security groups for both the auditors and administrators, and configure eligible role assignments (Reader and User Access Administrator respectively) in Privileged Identity Management (PIM) for those groups.
The design must leverage Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access. Creating security groups and configuring them with eligible role assignments (Reader for auditors and User Access Administrator for internal admins) ensures permissions are only activated when required and are managed collectively rather than individually, reducing overhead and maintaining the least privilege principle.

Adım Adım Çözüm

1
Identify the governance requirement for the external auditors.
The external auditors require temporary read-only access, which corresponds to the Reader role assigned as eligible using PIM, rather than a permanent active role.
Using PIM eligibility ensures access is only active when needed, meeting the least privilege and temporary access requirement.
2
Identify the governance requirement for the internal security administrators.
The internal administrators require role management capabilities during access reviews, which corresponds to the User Access Administrator role assigned as eligible in PIM.
Making the assignment eligible ensures administrative permissions are activated only on-demand during active reviews.
3
Determine the correct method for assigning roles to minimize administrative overhead.
Roles must be assigned to Microsoft Entra security groups rather than individual user accounts.
Group-based role assignments scale easily and reduce the administrative burden of individual permissions management.

Anahtar Kavram

Just-in-time (JIT) access governance using Microsoft Entra Privileged Identity Management (PIM) group-based eligible assignments.
Bu soruyu puanla

Konular

Entra ID Governance and Privileged Access