An audit of Contoso subscriptions finds 38 permanent Owner assignments on production subscriptions, and sign-in data shows that most of the holders have not used the permissions for 90 days. You must reduce standing privilege and make the remaining entitlements subject to periodic confirmation, without removing the ability to perform emergency changes. Which two actions should you perform? Each correct answer presents part of the solution.
Choose 2.
- A.
Enable security defaults in the Microsoft Entra tenant.
- B.
Apply a ReadOnly lock to each production subscription.
- C.
Convert the Owner assignments to eligible assignments for the Azure resource role in Microsoft Entra Privileged Identity Management.
- D.
Create a custom role that includes Microsoft.Authorization/roleAssignments/write and assign it to all 38 users.
- E.
Replace every Owner assignment with a Contributor assignment at the subscription scope.
- F.
Create an access review in Privileged Identity Management for the Owner role on each production subscription, with reviewers required to confirm continued need.
Show answer
Answer: C, F
Eligible assignments in PIM remove standing Owner privilege while keeping emergency activation, and access reviews force periodic confirmation of who still needs it.
- A. Security defaults enforce baseline authentication settings for the tenant and have no effect on Azure resource role assignments.
- B. A ReadOnly lock blocks all write operations, which directly contradicts the requirement to keep emergency changes possible.
- C. Eligibility eliminates standing Owner privilege while leaving a governed, time-bound activation path for emergencies.
- D. Granting role-assignment write rights hands out the most dangerous Owner permission and increases privilege rather than reducing it.
- E. Contributor is still broad standing privilege across the subscription and removes legitimate role-assignment capability during incidents.
- F. A recurring PIM access review forces reviewers to reconfirm each entitlement and can remove unused access automatically with an audit record.