AZ-500 Question 10
Select 2You are an Azure security engineer responsible for reducing excessive privileges across multiple Azure subscriptions using Microsoft Entra Permissions Management. After analyzing Microsoft Entra Permissions Management's usage data, you discover that several service accounts have rarely used permissions assigned, but your application team fears that removing them outright could cause operational issues. Which two actions should you take to safely rightsize privileges for these accounts using Microsoft Entra Permissions Management?
- A
Validate infrequent usage by reviewing permissions utilization in Microsoft Entra Permissions Management, then test changes in a non-production environment before finalizing removals.
- B
Immediately remove any rarely used permissions to ensure a strict least-privilege setup across all Azure subscriptions.
- C
Create a new Azure role definition based on permissions usage analytics from Microsoft Entra Permissions Management and implement it gradually to observe any unexpected impacts.
- D
Rely on Azure Role-Based Access Control (RBAC) logs exclusively to identify unused permissions, removing them without further testing or staged rollouts.
Show answer and explanation
Correct answers: A, C
Explanation
When rightsizing permissions in Azure, Microsoft Entra Permissions Management helps you identify unused or rarely used privileges. However, implementing least privilege without breaking production requires a staged approach, including thorough testing and custom role design. By combining its usage analytics with best practices, such as creating and testing updated role definitions in a non-prod environment, you reduce security risk while avoiding unintended outages. For more information, refer to Microsoft's documentation on implementing and managing Microsoft Entra Permissions Management: https://learn.microsoft.com/azure/active-directory/permissions-management.
- A. Correct.
Option 1 is correct. Verifying actual usage data from Microsoft Entra Permissions Management and testing changes in a controlled environment is a recommended best practice. This approach allows you to confirm that removing certain privileges will not break critical workflows.
- B. Incorrect.
Option 2 is incorrect. Immediately removing all rarely used permissions without a testing phase could introduce stability issues, especially if those privileges are occasionally needed. Overly aggressive privilege removal can disrupt production activities.
- C. Correct.
Option 3 is correct. Creating a custom role or a refined role definition using the analytics from Microsoft Entra Permissions Management and rolling it out gradually is a strategic way to ensure minimal disruption. You can revise it further as you learn more about actual usage.
- D. Incorrect.
Option 4 is incorrect. Relying solely on Azure RBAC logs and removing permissions without referencing Microsoft Entra Permissions Management data or testing can lead to misconfiguration. Permissions Management provides deeper insights and recommended actions based on actual usage patterns.