An organization named Apex Global Finance is designing a secure identity and access management solution using Microsoft Entra ID. The solution must meet the following requirements:
- Require multi-factor authentication (MFA) for all standard administrative users.
- Ensure that administrators only hold privileged permissions when they are actively performing administrative tasks.
- Minimize the risk of a tenant lockout if there is a widespread outage of the Azure MFA service.
Which two of the following configurations should you include in the identity design? (Select TWO).
- Create two cloud-only emergency access accounts that are explicitly excluded from all Conditional Access policies that require MFA.Cevap
- Configure standard administrative accounts as eligible for roles in Microsoft Entra Privileged Identity Management (PIM).Cevap
- CApply a single Conditional Access policy requiring MFA to all administrative accounts, without excluding any emergency access accounts.
- DConfigure standard administrative accounts as permanently active in Microsoft Entra Privileged Identity Management (PIM).
Cevap
To secure the administrative access while preventing lockout and minimizing standing privileges, the solution must include: creating cloud-only emergency access accounts that are excluded from MFA Conditional Access policies, and configuring standard administrative accounts as eligible for roles in Privileged Identity Management (PIM).
Excluding cloud-only emergency access accounts from MFA requirements in Conditional Access policies ensures a path into the tenant if the MFA service is unavailable. Configuring standard administrative accounts as eligible in Privileged Identity Management (PIM) enforces just-in-time access, which ensures roles are only activated when administrative tasks are performed.
Adım Adım Çözüm
Anahtar Kavram
Microsoft Entra ID emergency access and just-in-time access strategies using Conditional Access exclusions and PIM eligible assignments.
Tahmini Süre:2m 0s