AZ-500 Question 12
Select 2Your organization has deployed Microsoft Entra Permissions Management to manage permissions across Azure, AWS, and GCP. After scanning your Azure environment, you find that several user accounts and service principals hold roles with excessive permissions. Which TWO actions in Microsoft Entra Permissions Management help you enforce least privilege effectively?
- A
Grant the built-in Global Administrator role to all users to ensure centralized oversight
- B
Set up the Permission Creep Index to detect and remediate overprivileged roles
- C
Use Permission On-Demand features to enable just-in-time access for required tasks
- D
Configure mandatory multi-factor authentication in the Azure portal for all roles to remove unused privileges
Show answer and explanation
Correct answers: B, C
Explanation
Microsoft Entra Permissions Management provides centralized visibility and control of permissions across multiple clouds. Key capabilities include the Permission Creep Index to identify and streamline overprivileged roles, and just-in-time Permission On-Demand features to enforce least privilege on an as-needed basis. For more guidance, refer to Microsoft Entra Permissions Management documentation at https://learn.microsoft.com/azure/active-directory/cloud-infrastructure-entitlement-management.
- A. Incorrect.
Option 1 is incorrect. Assigning Global Administrator to all users would dramatically expand their privileges, contradicting the principle of least privilege and increasing security risks.
- B. Correct.
Option 2 is correct. The Permission Creep Index is a pivotal feature in Microsoft Entra Permissions Management that identifies and highlights overprivileged roles, enabling data-driven remediation strategies.
- C. Correct.
Option 3 is correct. Permission On-Demand (just-in-time) features reduce the time window in which permissions are active, mitigating risks from excessive role assignments.
- D. Incorrect.
Option 4 is incorrect as stated. While multi-factor authentication is a best practice for account security, it does not directly remove or remediate overprivileged roles in Microsoft Entra Permissions Management.