Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500)

Eligible approvers: Admin1 and Admin2 only

Based on the Privileged Identity Management (PIM) configuration table in the case study, the row for the AI Administrator role explicitly lists Admin1, Admin2 in the 'Approvers' column. This means that both Admin1 and Admin2 are designated as approvers for activation requests for this role.

Maximum active duration of the role: 1 day

The same PIM configuration table shows that for the AI Administrator role, the 'Activation maximum duration (hours)' is set to 24. Since 24 hours is equivalent to 1 day, this is the maximum period User1 can have the role activated after approval.

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Statement 1: Admin1 must approve requests for the Agent ID Developer role. ➡️️ Yes

Reasoning: The 'Privileged Identity Management (PIM) configuration' table explicitly shows that for the 'Agent ID Developer' role, the 'Require approval to activate' setting is 'Yes', and the designated 'Approvers' is 'Admin1'.

Statement 2: Admin2 can approve requests for the AI Administrator role. ➡️️ No

Reasoning: The PIM configuration table for the 'AI Administrator' role shows that the 'Require approval to activate' setting is 'No'. Since activation requests for this role do not require approval, there is no approval task for anyone, including Admin2, to perform.

Statement 3: Admin3 can assign User1 a two-day active assignment for the Agent ID Developer role. ➡️️ No

Reasoning: Admin3 holds the 'User Administrator' role. This role does not grant permissions to manage Privileged Identity Management (PIM) assignments. This action requires either the 'Privileged Role Administrator' role (held by Admin2) or the 'Global Administrator' role (held by Admin1).

Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

✅ Option C (Correct)
Reasoning: Enabling Microsoft Entra-only authentication for Server1 centrally enforces that SQL authentication is disabled for all databases on that logical server. This directly meets both requirements: SQL authentication cannot be used, and the solution is enforced at the server level.

❌ Why the other choices are incorrect:

• Option A is incorrect: Configuring a Microsoft Entra administrator allows Entra users to connect but does not disable SQL authentication centrally for the server.
• Option B is incorrect: Enabling a managed identity is for Azure resources to authenticate to other Azure services, not for disabling client SQL authentication to the server.
• Option D is incorrect: Removing SQL logins from DB1 is a database-specific action, not a server-level configuration that affects all databases or prevents the use of SQL authentication entirely.

✅ Option D (Correct)When user consent is disabled and delegated permissions are needed, an administrator must explicitly grant admin consent to the application. This allows App1 to access Microsoft Graph on behalf of signed-in users without triggering interactive consent prompts for each user, satisfying both requirements.❌ Why the other choices are incorrect:* Option A is incorrect: Requiring user assignment controls who can sign in but does not address the application's permission consent process for delegated permissions.* Option B is incorrect: Application permissions allow the app to act without a user, which contradicts the requirement to act "on behalf of the signed-in user".* Option C is incorrect: User consent is explicitly disabled in the tenant, making it impossible to rely on user consent during sign-in.

• B: Require approval to activate directly addresses the requirement that elevated access must be evaluated by another administrator before it is granted. This setting enforces an approval workflow for role activation.
• E: Activation maximum duration fulfills the requirement that privileged access must be removed automatically after a fixed period. This setting defines the maximum time an activated role can be held, after which access is automatically revoked.

✅ Option D (Correct)
Reasoning: By default, a Global Administrator does not have elevated access to Azure resources. Enabling 'Access management for Azure resources' grants the Global Administrator the User Access Administrator role at the root scope (/) of the Azure tenant. This permission then allows Admin1 to manage Azure RBAC roles for all subscriptions, including Sub1, enabling them to remove User1's Owner role.
❌ Why the other choices are incorrect:

• Option A is incorrect: Moving Sub1 to MG1 does not grant Admin1 the necessary permissions to manage roles on Sub1. Admin1 still lacks specific Azure RBAC permissions on the subscription.
• Option B is incorrect: Admin1 cannot assign themselves the User Access Administrator role for Sub1 because User1 is the sole owner. Admin1 needs a higher-level permission first to perform this assignment.
• Option C is incorrect: The Security Administrator role in Microsoft Entra ID does not grant Azure RBAC permissions to manage access to Azure subscriptions. PIM for this role is irrelevant for this scenario.

Assigning the policy to MG1 ensures all new Foundry deployments within the entire management group (Sub1 and Sub2) are governed. Excluding RG-Exception from this assignment explicitly prevents the policy from restricting deployments within that specific resource group, directly meeting both requirements. This method applies the policy broadly while providing a precise exemption.

To ensure App1 can retrieve secrets from KV1 without using credentials stored in the application configuration, a managed identity for App1 is the correct solution. A managed identity provides an Azure Active Directory identity for App1, allowing it to authenticate to Key Vault using RBAC without storing any secrets in its configuration. The existing firewall rule allowing access from App1's virtual network addresses network connectivity.

Correct Mapping:

✅ Step 1: Microsoft Authenticator matches with -> Passwordless sign-in
Reasoning: The Microsoft Authenticator app enables passwordless sign-in through phone sign-in. Users receive a push notification on their registered mobile device and approve it using a PIN or biometrics, meeting the requirement to sign in without a password using a mobile device.

✅ Step 2: Temporary Access Pass matches with -> First-time sign-in for new users
Reasoning: A Temporary Access Pass (TAP) is a time-limited, helpdesk-issuable passcode. Its primary purpose is to allow new users to sign in for the first time to register their permanent passwordless authentication methods, such as the Authenticator app. This perfectly aligns with the requirement for an expiring, helpdesk-issued method for new users.

Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-phone-sign-in

An app consent policy allows administrators to define the conditions under which users can consent to applications. This is the precise mechanism to enable users to grant consent for low-risk permissions while ensuring that requests for higher-privilege permissions still require administrator approval. You can create a custom app consent policy to categorize permissions and specify which ones users can consent to without admin intervention.

Why the other choices are incorrect:

• A is incorrect: Granting tenant-wide admin consent to App1 would approve all its permissions by an administrator, overriding individual user consent and not differentiating between low and high risk. It bypasses the requirement for users to grant consent for low-risk permissions.
• B is incorrect: Configuring application assignments controls which users or groups have access to the application, not the mechanism by which consent is granted.
• C is incorrect: Privileged Identity Management (PIM) is used for managing and monitoring administrative role assignments, not for defining user consent policies for applications.