Privileged Access and Break-Glass for a Cloud Migration
Fabrikam is migrating 300 on-premises servers to Azure. The identity team currently has 14 users in the Global Administrator role in Microsoft Entra ID, all with permanent assignments. An audit found that 9 of those 14 also hold standing access to the Azure subscription's Owner role. The team has Entra ID P2. Leadership wants to reduce standing privilege without blocking emergency recovery during the migration window, and wants an auditable approval trail for any elevation. One administrator objects: 'If we make roles eligible instead of active, we won't be able to respond to an outage at 2 a.m. because nobody can approve.'
1. Design the privileged access approach that reduces standing Global Administrator access while preserving 2 a.m. emergency response. Address the administrator's objection directly.
Read the worked answer
Use Privileged Identity Management (PIM) with a deliberate break-glass exception:
- Convert the 14 permanent Global Administrator assignments to eligible. PIM requires P2, which the org has. Eligible assignments mean the role is not active until activated.
- Configure activation settings: require justification, require approval for non-emergency roles, set a maximum activation duration (e.g., 2-4 hours), and require MFA on activation. This produces the auditable approval trail leadership asked for.
- Address the 2 a.m. objection with break-glass accounts, not by keeping 14 standing admins. Create 1-2 cloud-only emergency access accounts with permanent Global Administrator, excluded from Conditional Access and PIM, with long random credentials stored offline and monitored. These cover genuine emergencies without approval dependency. This is the standard answer to 'we can't wait for approval during an outage.'
- Separate the Azure RBAC layer. The 9 users with standing Owner on the subscription should also move to PIM for Azure resources (eligible Owner), since PIM governs both Entra roles and Azure resource roles.
- Add access reviews on the eligible assignments so the population doesn't creep back.
The judgment point: emergency access is solved by a small, tightly controlled break-glass path - not by leaving broad standing privilege in place.
2. The audit wants proof that elevation is justified and reviewed. Which PIM configuration elements produce that evidence, and what is a common mistake that undermines it?
Read the worked answer
Evidence-producing elements:
- Justification required on activation - captured in PIM audit history.
- Approval workflow - records who approved and when, creating the approval trail.
- Activation duration limits - bounds the exposure window and is logged.
- Access reviews on eligible assignments - recurring attestation that access is still needed, with reviewer decisions recorded.
- PIM audit history and alerts - e.g., alerts for roles activated too often or assignments made outside PIM.
Common mistake that undermines it: leaving a parallel set of permanent assignments (or direct role assignments made outside PIM) so people never actually activate through the governed path. If standing assignments remain, the audit trail is incomplete because the real access never went through approval. Another mistake is excluding too many accounts from PIM 'for convenience,' which recreates standing privilege. The exam favors recognizing that governance only holds if PIM is the sole path to the role.