A manufacturer's identity and Azure control-plane administrators perform privileged administration from the same laptops they use for email and general web browsing, signing in with the same Microsoft Entra accounts they use for everyday productivity. After a credential-theft incident, the architect must redesign privileged administration under the enterprise access model so that a phishing or browser-borne compromise of an everyday productivity surface cannot expose or reuse control-plane credentials. Which two design elements together most directly satisfy this isolation requirement? Select TWO.
- AIssue separate cloud-only Microsoft Entra accounts that are used exclusively for control-plane administration and never for email or browsing, so a credential phished from a productivity account holds no privileged role to abuse. Correct
- BRequire phishing-resistant multifactor authentication on the administrators' everyday laptops, so they prove a stronger identity on the same device before they perform any control-plane administration task.
- CTighten Conditional Access named locations so that control-plane administration is permitted only from the corporate IP ranges the administrators' laptops egress through, blocking privileged sign-ins from elsewhere.
- DProvide dedicated privileged access workstations, hardened and restricted to administrative endpoints with no general internet browsing or arbitrary applications, as the only origin from which control-plane administration is performed. Correct
Why A is correct: Dedicated administrative accounts decouple privilege from the productivity identity, so a credential stolen from the day-to-day account confers no control-plane access, which directly enforces the enterprise access model's separation of privileged identities from high-exposure productivity use.
Why B is wrong: Phishing-resistant multifactor authentication raises sign-in assurance and is tempting because it strengthens privileged sign-in, but performing administration from a device that also browses the web and reads mail leaves the session and tokens exposed to a browser-borne compromise, so the high-risk productivity surface still reaches the control plane.
Why C is wrong: Restricting privileged sign-in to corporate network locations narrows where administration can occur and is appealing as a verify-explicitly control, but it still allows the same compromised everyday laptop inside that range to administer the control plane, so it addresses the source network rather than the contaminated device and shared identity.
Why D is correct: A privileged access workstation gives administration a clean, locked-down origin that never doubles as a browsing or email surface, removing the high-risk productivity exposure that lets a phishing or web compromise reach the control plane and satisfying the enterprise access model's secured-workstation requirement.