AZ-305 Question 55
Select 2Your organization has several external contractors who require elevated access to specific Azure resources for short-term projects. You need to ensure that these external users only have privileged access when actively working on a project, and that their permissions are regularly recertified to prevent unnecessary long-term access. Which two Azure AD features should you implement to meet these requirements?
- A
- Azure AD Privileged Identity Management (PIM)
- B
- Azure AD Conditional Access policies
- C
- Azure AD Access Reviews
- D
- Self-service password reset (SSPR) in Azure AD
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirement of granting short-term privileged access and periodically reviewing that access, Azure AD Privileged Identity Management (PIM) provides just-in-time role activation, and Azure AD Access Reviews schedules recurring reviews for assigned roles. Combining these features addresses the core identity governance needs of time-limited access and permission recertification for external contractors. For more detail, refer to Microsoft’s documentation on Azure AD PIM (https://learn.microsoft.com/azure/active-directory/privileged-identity-management/) and Azure AD Access Reviews (https://learn.microsoft.com/azure/active-directory/governance/access-reviews-overview).
- A. Correct.
Option 1: Azure AD Privileged Identity Management (PIM), CORRECT. PIM allows you to grant just-in-time (JIT) privileges, requiring users to activate their roles only when needed. This helps limit exposure by reducing the time a user has permanent privileged access to Azure resources.
- B. Incorrect.
Option 2: Azure AD Conditional Access policies, INCORRECT. While Conditional Access helps enforce policies such as multi-factor authentication or location-based sign-in risk, it does not itself manage role assignments or conduct permission recertifications. It’s important for securing access but not sufficient for controlling temporary privileged access or periodic review of roles.
- C. Correct.
Option 3: Azure AD Access Reviews, CORRECT. Access Reviews enable regularly scheduled recertification of user privileges. You can configure reviews to expire or remove user access automatically if they are no longer active on the project or if they do not respond to the review request.
- D. Incorrect.
Option 4: Self-service password reset (SSPR) in Azure AD, INCORRECT. SSPR allows users to reset or unlock their own passwords but does not affect how privileges are assigned or reviewed. It addresses password management rather than identity governance of privileged roles.