An enterprise is planning the deployment of an Azure landing zone. A team of fifteen external database consultants requires temporary administrative control over the resources in a production subscription to perform database schema updates. Security policy mandates that:
* Access must be granted on a temporary, just-in-time (JIT) basis.
* The administrative privilege must not exceed four hours per activation.
* All activation requests must be approved by an internal security lead.
* To maintain clean subscription-level access controls, privileges should not be assigned directly to individual consultant user accounts.
Which two configurations should you include in the privileged access and identity governance design? (Select TWO.)
- Configure the subscription Owner role settings in Microsoft Entra Privileged Identity Management (PIM) to require approval and set the maximum activation duration to four hours.Cevap
- Assign eligibility for the subscription Owner role to a Microsoft Entra ID security group containing the external consultants' accounts.Cevap
- CAssign the external consultants' user accounts directly as eligible for the Owner role in Microsoft Entra Privileged Identity Management (PIM).
- DConfigure active permanent assignments to the subscription Owner role for the consultants and schedule access reviews to run every four hours.
Cevap
To meet the requirements, configure the subscription Owner role settings in Privileged Identity Management to require approval and a maximum activation duration of four hours, and assign the eligibility for the Owner role to a Microsoft Entra ID security group containing the external consultants.
Configuring the role settings in Microsoft Entra Privileged Identity Management (PIM) ensures that the activation duration is capped at four hours and requires approval. Assigning this eligibility to a security group rather than individual users prevents administrative overhead and respects the organization's governance rules.
Adım Adım Çözüm
Anahtar Kavram
Using group-based eligibility and role settings in Privileged Identity Management (PIM) to secure administrative access.