AZ-305 Question 52
Select 2Contoso employs short-term external contractors who need elevated privileges to access certain Azure resources. These contractors rotate frequently, and Contoso wants to ensure privileged access is granted only on an as-needed basis, with an approval process. They also want to periodically review and remove any unnecessary access. Which two approaches should Contoso implement to meet these requirements? (Choose two)
- A
Enable Azure AD Privileged Identity Management (PIM) for just-in-time access to administrative roles
- B
Configure Access Reviews in Azure AD Identity Governance to periodically review and remove contractor access
- C
Use Azure AD B2C to streamline external user sign-in and automatically handle privileged role requests
- D
Create a spreadsheet-based process to manually track and revoke external contractor privileges
Show answer and explanation
Correct answers: A, B
Explanation
Azure AD offers built-in Identity Governance tools, particularly PIM for just-in-time role assignments and Access Reviews for periodic entitlement checks. Together, they help reduce security risks by minimizing standing privileges and ensuring external contractors’ access is regularly evaluated. For more information, see the Microsoft documentation on Privileged Identity Management (https://learn.microsoft.com/azure/active-directory/privileged-identity-management/) and Access Reviews (https://learn.microsoft.com/azure/active-directory/governance/access-reviews-overview).
- A. Correct.
Option 1 is correct. Azure AD Privileged Identity Management (PIM) enables on-demand, time-bound access to privileged roles with an approval workflow. This ensures contractors only have elevated rights when needed and reduces standing administrative privileges.
- B. Correct.
Option 2 is correct. Azure AD Identity Governance Access Reviews allow automatic, periodic evaluations of user privileges (including external contractors), making it easier to detect and remove stale or unnecessary entitlements.
- C. Incorrect.
Option 3 is incorrect. While Azure AD B2C is useful for consumer identity and external user sign-in scenarios, it is not designed for just-in-time privileged access requests or periodic access reviews. Privileged Identity Management and Access Reviews are more appropriate for these tasks.
- D. Incorrect.
Option 4 is incorrect. Manually tracking privileges in spreadsheets is error-prone and does not integrate with Azure’s capabilities to automate the review and approval process. This option cannot handle frequent rotations efficiently.