An enterprise is designing a subscription governance strategy for a multi-region deployment. The compliance team requires that database administrators are only allowed to manage database resources in the 'DB-Prod-RG' resource group. Additionally, the database administrators should only receive these privileges when actively performing maintenance tasks, and all permissions must be audit-compliant and managed centrally to reduce administrative overhead.
Which two configurations should you include in the design to meet these requirements?
- Create a Microsoft Entra ID security group containing the database administrator user accounts, and assign roles to the group instead of individual users.Cevap
- Configure Microsoft Entra Privileged Identity Management (PIM) to make the security group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.Cevap
- CAssign the SQL DB Contributor role directly to the individual database administrator user accounts at the 'DB-Prod-RG' resource group scope.
- DConfigure Microsoft Entra Privileged Identity Management (PIM) to make the security group permanently active in the SQL DB Contributor role at the subscription scope.
Cevap
The correct configurations are to create a Microsoft Entra ID security group containing the database administrator user accounts, and configure Microsoft Entra Privileged Identity Management (PIM) to make the group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.
Assigning roles to a Microsoft Entra security group reduces administrative overhead and ensures governance scales effectively. Using Microsoft Entra Privileged Identity Management (PIM) with an eligible role assignment at the resource group scope enables database administrators to request just-in-time (JIT) access specifically for database maintenance tasks, adhering to the principle of least privilege.
Adım Adım Çözüm
Anahtar Kavram
Azure RBAC and Subscription Governance