Hotspot Question Your organization has developed and deployed several Azure App Service Web and API applications. The applications use Azure Key Vault to store several authentication, storage…

Question

Exhibits

Answer Area

• SecurityAzure AD Privileged Identity Management
  Azure AD Privileged Identity ManagementAzure AD Managed Service IdentityAzure AD ConnectAzure AD Identity Protection
• DevelopmentAzure AD Managed Service Identity
  Azure AD Privileged Identity ManagementAzure AD Managed Service IdentityAzure AD ConnectAzure AD Identity Protection
• Quality AssuranceAzure AD Privileged Identity Management
  Azure AD Privileged Identity ManagementAzure AD Managed Service IdentityAzure AD ConnectAzure AD Identity Protection

Explanation

1. Security => Azure AD Privileged Identity Management (PIM):

   • Request: The Security department needs to review and justify administrative role memberships, receive alerts on admin assignment changes, and view a history of administrator activations and resource changes.
   • Rationale: Azure AD PIM is designed to manage and monitor privileged access. Its features directly address these requirements by enabling access reviews to ensure continued need for roles, requiring justification for role activation, providing notifications when privileged roles are activated, and allowing the download of audit history for administrative actions. PIM mitigates risks associated with excessive or misused access permissions.

2. Development => Azure AD Managed Service Identity (MSI):

   • Request: The Development department needs to enable applications to securely access Azure Key Vault and retrieve keys without storing credentials in code.
   • Rationale: Managed identities provide an identity for applications (like Azure App Service Web and API applications) to use for Azure AD authentication. This allows applications to obtain Azure AD tokens to securely access other Azure resources that support Azure AD authentication, such as Azure Key Vault, without needing to manage secrets or credentials in their code.

3. Quality Assurance => Azure AD Privileged Identity Management (PIM):

   • Request: The Quality Assurance department requires temporary administrator access to create and configure applications in a test environment.
   • Rationale: Azure AD PIM is ideal for this scenario as it provides just-in-time privileged access to Azure resources. It allows for time-bound access assignments with start and end dates, ensuring that administrative access is temporary and provisioned only when needed, aligning with the requirement for temporary administrator access.

No community discussion yet for this question.