AZ-305 - Design Identity, Governance, and Monitoring Solutions - Section 1.2

Design authentication and authorization solutions using Microsoft Entra and Azure RBAC.

Design authentication and authorisation solutions using Microsoft Entra ID, Managed Identity, and Conditional Access to control who can reach which resources. Apply Azure RBAC for least-privilege access and use Privileged Identity Management to govern just-in-time elevation of sensitive roles.

Microsoft Entra IDManaged IdentityAzure RBACConditional AccessPrivileged Identity Management

Practice question for this objective

Free sampleDesign Identity, Governance, and Monitoring Solutionshard

A subscription Owner enabled PIM for Azure resource roles and wants to grant a senior engineer the ability to manage assignments on those roles for other administrators. The engineer holds no Microsoft Entra ID role. Which assignment satisfies the requirement with least privilege?

  • APrivileged Role Administrator in Microsoft Entra ID, because that role manages all PIM assignments globally regardless of scope.
  • BSecurity Administrator in Microsoft Entra ID, because Security Administrator manages PIM Azure resource role activations and assignments.
  • CUser Access Administrator at the subscription scope, the least-privileged role that can manage PIM Azure resource role assignments. Correct
  • DGlobal Reader in Microsoft Entra ID, because Reader cascades to PIM Azure resource role assignment management across the tenant.
Azure resource role PIM assignments are managed by User Access Administrators or resource Owners, not by Privileged Role Administrator. For Azure resource roles in PIM, only a subscription administrator, resource Owner, or resource User Access Administrator can manage assignments for other administrators. User Access Administrator at the subscription scope is the least-privileged option among the documented set.

Why A is wrong: Privileged Role Administrator governs Microsoft Entra ID roles in PIM; it does not by default have access to manage Azure resource role assignments in PIM.

Why B is wrong: Security Administrator can view but does not by default manage PIM Azure resource role assignments.

Why C is correct: Correct. For Azure resource roles in PIM, only a subscription administrator, resource Owner, or resource User Access Administrator can manage assignments for other administrators.

Why D is wrong: Global Reader is read-only across Microsoft Entra ID and never grants the ability to manage assignments.

See more AZ-305 practice questions, answers explained.

More in this domain

Back to all Design Identity, Governance, and Monitoring Solutions objectives, or the AZ-305 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.