Design identity, governance, and monitoring solutions practice questions

Microsoft Entra ID Privileged Identity Management and Access Reviews

Why wrong: Incorrect. These features manage privileged roles and periodic access reviews, not real-time risk-based conditional access.

Microsoft Entra ID B2B and External Identities

Why wrong: Incorrect. These features facilitate collaboration with external users, not conditional access based on risk.

Microsoft Entra ID Domain Services and Managed Identities

Why wrong: Incorrect. Microsoft Entra ID DS provides domain services for VMs, and Managed Identities are for application credentials, neither addresses conditional access with risk.

Azure Log Analytics workspace with Microsoft Entra ID diagnostic settings

Why wrong: Incorrect. While you can stream logs from multiple tenants to a single Log Analytics workspace, the analysis capabilities are more limited without Sentinel's built-in SIEM features.

Microsoft Entra ID Reports and Monitoring

Why wrong: Incorrect. Microsoft Entra ID built-in reports only show data for a single tenant and do not provide cross-tenant aggregation.

Azure Monitor Workbooks

Why wrong: Incorrect. Workbooks are for visualizing data within a workspace but do not address ingesting or analyzing data from multiple tenants.

Microsoft Entra ID B2C.

Why wrong: Microsoft Entra ID B2C is used for customer identity and access management in customer-facing applications. It is not designed for partner access to Office 365 resources.

Microsoft Entra ID Conditional Access.

Why wrong: Conditional Access enforces policies like MFA or location-based restrictions but does not provide the ability to request access or set expirations. It is a control mechanism, not an access management solution for external users.

Microsoft Entra ID Identity Protection.

Why wrong: Identity Protection detects risk and can automatically remediate, such as blocking sign-ins. It does not provide the access request and approval workflow needed.

Azure Policy with built-in policy to enforce MFA and Azure Activity Log to monitor changes.

Why wrong: Azure Policy can audit whether MFA is enabled on accounts, but it cannot enforce MFA during sign-in. It is not the correct tool for requiring MFA at authentication time. Activity Log can capture policy changes, but the enforcement method is wrong.

Microsoft Entra ID Identity Protection to enforce MFA and Azure Sentinel for monitoring.

Why wrong: Identity Protection offers risk-based conditional access (e.g., require MFA for risky sign-ins), but it is not designed to enforce MFA for all administrators regardless of risk. Azure Sentinel is a SIEM that could ingest logs, but it is unnecessary for the stated requirement for basic monitoring of policy changes; Azure Monitor is simpler and sufficient.

Azure Policy to assign built-in policy 'MFA should be enabled on accounts with write permissions' and Azure Security Center for monitoring.

Why wrong: This policy audits whether MFA is enabled, but again does not enforce MFA during authentication. Azure Security Center (now Defender for Cloud) focuses on security posture and workload protection, not on monitoring identity policy changes.

Microsoft Entra ID Privileged Identity Management (PIM)

Why wrong: PIM is designed for managing, controlling, and monitoring access to privileged roles, not for automating general resource access or granting access to external partners.

Microsoft Entra ID Conditional Access

Why wrong: Conditional Access enforces policies during sign-in based on conditions like location or device state, but it does not manage the lifecycle of access assignments or perform access reviews.

Microsoft Entra ID Identity Protection

Why wrong: Identity Protection detects and responds to identity risks such as compromised accounts, but it does not automate access provisioning or conduct access reviews.

Identity Protection and Conditional Access

Why wrong: Identity Protection detects risky sign-ins and Conditional Access enforces policies, but neither manages privileged role activation or access reviews.

Entitlement Management and Conditional Access

Why wrong: Entitlement Management manages access packages for resources, not privileged roles. Conditional Access provides sign-in controls, not reviews.

Microsoft Entra ID Access Reviews and Identity Protection

Why wrong: Access Reviews can review assignments but without PIM, it does not enforce just-in-time activation with approval for privileged roles.

Azure Log Analytics

Why wrong: Log Analytics is a component within Azure Monitor used for log queries and analysis, but it is not the overall monitoring platform; it requires Azure Monitor as the parent service.

Azure Application Insights

Why wrong: Application Insights is focused on application performance monitoring (APM) and custom metrics from applications, but it does not collect infrastructure metrics from all Azure resources.

Azure Service Health

Why wrong: Azure Service Health provides information about service impacting issues and planned maintenance from Azure, not resource-level monitoring or custom metrics.

B

Why wrong: Azure Service Health and Azure Advisor provide status notifications and best practices, but they do not collect custom metrics or support custom dashboards and alerts based on performance counters.

C

Why wrong: Application Insights is designed for monitoring live web applications, not for collecting server-level performance metrics from on-premises or Azure VMs.

D

Why wrong: Azure Sentinel is a SIEM tool for security monitoring, not the primary platform for general performance and operational monitoring.

A

Why wrong: Microsoft Entra ID Identity Protection provides risk-based policies (e.g., sign-in risk) but does not directly enforce device compliance or session timeout controls.

C

Why wrong: Privileged Identity Management (PIM) is for managing elevated roles, not for enforcing MFA or device compliance for external B2B users.

D

Why wrong: Microsoft Entra ID Access Reviews allow periodic review of access, but they do not enforce real-time conditions like MFA or device compliance during sign-in.

Microsoft Entra ID Identity Protection

Why wrong: Identity Protection detects risky sign-ins but does not directly enforce MFA based on location; it integrates with Conditional Access for enforcement.

Microsoft Entra ID Privileged Identity Management

Why wrong: PIM manages just-in-time access to privileged roles, not general user MFA policies.

Microsoft Entra ID Self-Service Password Reset

Why wrong: SSPR allows users to reset their own passwords and does not involve MFA policy enforcement.

Microsoft Entra ID Identity Protection

Why wrong: Identity Protection identifies risky sign-ins but does not directly enforce controls; it provides signals for Conditional Access.

Microsoft Entra ID Privileged Identity Management

Why wrong: PIM manages activation of administrative roles, not general user sign-in risk policies.

Microsoft Entra ID Audit Logs

Why wrong: Audit Logs provide logs of activities but do not allow policy creation or automatic enforcement.

Microsoft Entra ID Connect

Why wrong: Microsoft Entra ID Connect synchronizes on-premises directory objects to Microsoft Entra ID, not to SaaS applications.

Microsoft Entra ID Application Proxy

Why wrong: Application Proxy enables secure remote access to on-premises web applications, not lifecycle management.

Microsoft Entra ID Entitlement Management

Why wrong: Entitlement Management manages access packages and access reviews but does not automatically create or deactivate accounts based on user lifecycle.

Microsoft Entra ID B2B

Why wrong: Microsoft Entra ID B2B (Business-to-Business) is intended for collaboration with external business partners, not consumers. It does not support social identity providers like Google or Facebook out of the box.

Microsoft Entra ID Identity Protection

Why wrong: Microsoft Entra ID Identity Protection is for identifying and responding to identity-based risks, not for integrating external identity providers.

Microsoft Entra ID Conditional Access

Why wrong: Conditional Access policies enforce access controls based on conditions like location, device, etc. It does not provide identity federation or custom sign-up flows.

Microsoft Entra ID Identity Protection

Why wrong: Identity Protection focuses on detecting risky sign-ins and user behavior, not on enforcing MFA based on location and device compliance. It can require MFA on risky sign-ins but not with custom location exclusions.

Microsoft Entra ID Privileged Identity Management

Why wrong: PIM is used for managing, controlling, and monitoring access to privileged roles in Microsoft Entra ID. It does not handle MFA policies for general access to applications.

Microsoft Entra ID Identity Governance

Why wrong: Identity Governance includes features like access reviews and entitlement management, which are used for managing access lifecycles, not for enforcing MFA policies.

Dynamic Groups

Why wrong: Dynamic Groups are used for automatic group membership based on rules, not for delegating administrative scope.

Microsoft Entra ID B2B

Why wrong: Microsoft Entra ID B2B is for external collaboration and guest user access, not for delegation of administration.

Microsoft Entra ID Identity Protection

Why wrong: Microsoft Entra ID Identity Protection is a security tool for detecting risks and automating responses to identity threats, not for delegating administrative scope.

Azure Blueprints with tag policy and Azure RBAC, and Azure Security Center for compliance

Why wrong: Blueprints are not necessary for this requirement, and Azure Security Center does not generate tag compliance reports.

Azure Policy for tag enforcement, Azure Management Groups for governance, and Azure Monitor for compliance reports

Why wrong: Management Groups help organize subscriptions but do not enforce policies or generate compliance reports; Azure Monitor does not produce policy compliance reports.

Azure Policy for tag enforcement, Azure RBAC for tag modification, and Azure Security Center for compliance

Why wrong: Azure Security Center is focused on security recommendations, not tag compliance reporting.

Use Microsoft Entra ID Identity Protection to detect risky activations and trigger a Logic App

Why wrong: Identity Protection is designed for risky sign-ins and user risk, not specifically for PIM role activations.

Enable Microsoft Entra ID diagnostic settings to send logs to Event Hubs and process with Azure Stream Analytics

Why wrong: Event Hubs and Stream Analytics can process logs, but this is an over-engineering; simpler log analytics alert is sufficient.

Use Azure Sentinel with a built-in connector for PIM and create a scheduled analytics rule

Why wrong: Azure Sentinel can do this, but it is a more complex and expensive SIEM; the requirement does not indicate need for full SIEM.

Create a Conditional Access policy for external users that requires MFA and compliant device, and set session controls for sign-in frequency. Trusting MFA from external tenants is automatic.

Why wrong: MFA from external tenants is not automatically trusted. You must explicitly configure cross-tenant access settings to trust the MFA and device compliance claims.

Use Microsoft Entra ID Identity Protection to detect risky sessions for external users and require MFA only when risk is high. This will also enforce device compliance automatically.

Why wrong: Identity Protection can detect risk for external users, but it does not enforce device compliance. Device compliance must be enforced via Conditional Access with cross-tenant trust.

Configure Microsoft Entra ID Privileged Identity Management (PIM) for external users to activate MFA and require compliant device. PIM is for role activation, not for external user access policies.

Why wrong: PIM is designed for just-in-time privileged access, not for enforcing MFA or device compliance on external B2B users.

Microsoft Entra ID Privileged Identity Management (PIM)

Why wrong: PIM is used for just-in-time activation of privileged roles (e.g., Global Administrator). It does not manage access to general applications or Microsoft 365 groups.

Microsoft Entra ID Conditional Access

Why wrong: Conditional Access controls access based on conditions like location, device, and risk. It does not automate access requests, approvals, or reviews.

Microsoft Entra ID Self-Service Group Management

Why wrong: Self-service group management allows users to create groups and manage membership, but it does not support predefined approval workflows, expiration, or periodic access reviews.

Microsoft Entra ID Audit logs

Why wrong: Audit logs record changes to Microsoft Entra ID objects (e.g., user updates, policy changes), not sign-in attempts.

Microsoft Entra ID Provisioning logs

Why wrong: Provisioning logs track when users are created, updated, or deleted in external applications (e.g., ServiceNow), not sign-in events.

Office 365 Activity logs

Why wrong: Office 365 activity logs record actions in Microsoft 365 services, not sign-in attempts to Microsoft Entra ID-integrated applications.