AZ-305 Practice Question 12: Privileged Access Lifecycle
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 2 · question 2 of 10
An auditor reviewing a bank's Azure estate finds that 22 engineers hold permanent Owner assignments on the production subscription. The remediation plan must satisfy all of the following:
- No engineer holds standing Owner permissions. - An engineer can obtain Owner for a limited window, but only after multifactor authentication, a written justification, and approval by a named approver. - Every quarter, someone must confirm that each engineer still needs the ability to obtain Owner. - Activation and approval history must be exportable for the external auditor.
Which solution should you recommend?
Show answer and explanation
Answer:
Privileged Identity Management provides time-based and approval-based role activation for Azure resource roles. An *eligible* assignment grants nothing until the user activates it, and the role settings can require multifactor authentication, a justification, and approval by designated approvers before activation, with the elevation expiring automatically after a configured maximum duration. PIM also runs access reviews so role eligibility is recertified on a schedule, and it keeps downloadable audit history of assignments, activations, and approvals. Each of the four requirements maps to one PIM capability.
Option A only narrows the blast radius. The engineers still hold permanent standing access, there is no activation, approval, or expiry, and nothing recertifies the assignment; the auditor's central finding is untouched. Writing a custom role also adds definition maintenance for no governance gain.
Option B strengthens authentication but not authorization. Conditional Access decides how a user proves who they are at sign-in; it does not make permissions temporary, does not introduce an approver, and does not review who is entitled to what. The engineers would keep Owner permanently.
Option D reproduces a fraction of PIM with custom code and human process. There is no enforced MFA at activation, no approval record tied to the elevation, no automatic expiry if the morning cleanup fails, and the audit trail is a ticket queue rather than the directory's own log, while the service desk itself must now hold rights to grant Owner.
Reference: What is Microsoft Entra Privileged Identity Management?