An enterprise is designing a security and subscription governance strategy for its Azure environment. Which two of the following configurations align with Microsoft best practices for scalable access control and the principle of least privilege?
- Create Microsoft Entra ID groups for administrative functions and assign the required Azure RBAC roles to these groups.Cevap
- BAssign Azure RBAC roles directly to individual user accounts to guarantee precise user-level audit tracking.
- Configure Microsoft Entra Privileged Identity Management (PIM) role assignments as eligible rather than permanently active.Cevap
- DConfigure Microsoft Entra Privileged Identity Management (PIM) assignments as permanently active to reduce access activation overhead.
Cevap
The correct configurations are to assign Azure RBAC roles to Microsoft Entra ID groups instead of individual users, and to configure Microsoft Entra Privileged Identity Management (PIM) role assignments as eligible instead of permanently active.
Assigning roles to Microsoft Entra ID groups instead of individual users simplifies administration and ensures scalability. Using Privileged Identity Management (PIM) with eligible assignments enforces the principle of least privilege through just-in-time access control, requiring activation rather than granting standing privileges.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC Group Assignment and PIM Just-In-Time Access