Microsoft Cybersecurity Architect (SC-100)Design a Zero Trust strategy and architectureEasy
A company is implementing a Zero Trust strategy and needs to establish a robust identity governance framework. The organization uses Azure Active Directory (Azure AD) for identity management and has several business-critical applications, some of which require highly privileged access. The security architect must ensure that access reviews are regularly conducted for these privileged roles to prevent privilege creep and maintain compliance. Which Azure AD capability is BEST suited for automating and managing these access reviews?
- AAzure AD Conditional Access
- BAzure AD PIM (Privileged Identity Management)
- CAzure AD Connect
- DAzure AD Identity Protection
Show answer & explanationAnswer & explanation
Correct answer: B. Azure AD PIM (Privileged Identity Management)
Azure AD PIM is specifically designed to manage, control, and monitor access to important resources, including privileged roles, by providing just-in-time access and facilitating regular access reviews.
Why the other options are wrong
- A. Conditional Access is for enforcing policies based on conditions at the time of access, not for managing lifecycle or reviewing existing access.
- C. Azure AD Connect synchronizes on-premises directories with Azure AD and is not used for privileged access management or access reviews.
- D. Identity Protection detects and remediates identity-based risks, such as compromised credentials, but doesn't manage access reviews for privileged roles.
Azure AD PIM
Azure Active Directory Privileged Identity Management (PIM) is a service in Azure AD that enables you to manage, control, and monitor access to important resources in your organization.
- Provides just-in-time (JIT) privileged access.
- Facilitates regular access reviews for privileged roles.
- Enables multi-factor authentication for role activation.
Memory trick: PIM protects Privileged Identities, while Conditional Access controls conditions.