Hotspot Question You have several Azure App Service web apps that use Azure Key Vault to store data encryption keys. Several departments have the following requests to support the web app: Which…

Question

Exhibits

Answer Area

• Security:Azure AD Privileged Identity Management
  Azure AD Privileged Identity ManagementAzure Managed IdentityAzure AD ConnectAzure AD Identity Protection
• Development:Azure Managed Identity
  Azure AD Privileged Identity ManagementAzure Managed IdentityAzure AD ConnectAzure AD Identity Protection
• Quality Assurance:Azure AD Privileged Identity Management
  Azure AD Privileged Identity ManagementAzure Managed IdentityAzure AD ConnectAzure AD Identity Protection

Explanation

This question asks to recommend the appropriate Azure service for different departmental requests related to Azure App Service web apps using Azure Key Vault.

Security: Azure AD Privileged Identity Management (PIM)

The Security department's requests align with the capabilities of Azure AD Privileged Identity Management. PIM enables organizations to:

• Review administrative roles and require justification: This is covered by PIM's features to 'Conduct access reviews to ensure users still need roles' and 'Use justification to understand why users activate'.
• Get alerts about administrator assignment changes: PIM provides notifications when privileged roles are activated.
• See a history of administrator activation: PIM allows for downloading audit history for internal or external audit.

Development: Azure Managed Identity

The Development department needs to enable applications to securely access Key Vault without managing credentials directly. Azure Managed Identities provide an identity for applications, allowing them to obtain Azure AD tokens to access resources like Azure Key Vault. This eliminates the need for developers to store or manage credentials in code, enhancing security and simplifying application development.

Quality Assurance: Azure AD Privileged Identity Management (PIM)

The Quality Assurance department requires temporary administrator access for specific tasks (creating and configuring web apps in a test environment). PIM is ideal for this by providing:

• Temporary administrator access: PIM offers 'just-in-time privileged access' and allows assigning 'time-bound access to resources using start and end dates'. This ensures that the QA team receives only the necessary access for a limited duration, enhancing the principle of least privilege.

No community discussion yet for this question.