AZ-500 Question 3
Select 2You are the Security Administrator for an organization whose Azure AD tenant has technical support staff permanently assigned to the Global Administrator role. Leadership wants to follow the principle of least privilege by providing elevated privileges only when needed and requiring approval from the senior security team before support staff can activate Global Administrator privileges. Which two steps should you take?
- A
Enable Azure AD Privileged Identity Management (PIM) and make support staff “Eligible” for the Global Administrator role.
- B
Configure the role in PIM to require approval for any role activation.
- C
Remove all role assignments from support staff and rely on an external provisioning tool to add or remove roles as needed.
- D
Enable multi-factor authentication for support staff on every sign-in.
Show answer and explanation
Correct answers: A, B
Explanation
To address the need for just-in-time privileged access and an approval workflow, the most direct approach is to use Azure AD Privileged Identity Management. By assigning support staff as 'Eligible' users for the Global Administrator role (Option 1) and configuring the role settings to require approval for activation (Option 2), you ensure that privileges are elevated only when needed, and a senior security admin must approve each activation. Refer to Microsoft’s documentation on Privileged Identity Management (https://docs.microsoft.com/azure/active-directory/privileged-identity-management) for detailed guidance on how to configure these settings.
- A. Correct.
Option 1 is correct. Azure AD Privileged Identity Management allows you to assign users as 'Eligible' rather than permanently active in a privileged role. This feature is necessary to implement just-in-time access to Global Administrator privileges.
- B. Correct.
Option 2 is correct. Requiring approval for role activation ensures that a senior security admin must approve any elevation of privileges, fulfilling the leadership's requirement for additional oversight.
- C. Incorrect.
Option 3 is incorrect. Removing all role assignments and depending on an external tool doesn't satisfy the requirement to provide elevated privileges in a controlled but still manageable way. External provisioning doesn’t inherently offer just-in-time access or approval workflows for privileged roles within Azure AD.
- D. Incorrect.
Option 4 is incorrect. While enabling MFA is highly recommended for all users (including privileged ones), it does not address the specific requirement of requiring approval for role elevation. MFA alone does not provide just-in-time role activation or the necessary approval process.