Design authentication and authorization solutions

Fairleigh Insurance has a production subscription named sub-claims-prod. Six platform engineers occasionally need Owner rights there to resolve incidents. Auditors require that no one holds standing Owner access, that every elevation is approved by a manager, requires MFA, lasts no more than four hours, and is recorded with a justification. The engineers already have Microsoft Entra ID P2 licenses.

What should you recommend?

1. AAssign the engineers the Owner role permanently on sub-claims-prod and require MFA through Conditional AccessThis leaves standing Owner access in place and provides neither approval, time limits, nor justification.
2. BMake the engineers eligible for the Owner role on sub-claims-prod in Privileged Identity Management, with approval, MFA, justification, and a four-hour maximum activationPIM for Azure resources converts the assignment to eligible, so the role is only active after a just-in-time activation that can enforce MFA, approval, justification, and a maximum duration, and all activations are audited.
3. CAssign the Owner role to a group and run a quarterly Entra access review of the groupAccess reviews periodically confirm membership but do not remove standing access or add per-elevation approval and time limits.
4. DCreate an Azure Policy that audits Owner role assignments on the subscriptionPolicy can report on assignments but cannot make access just-in-time or require approval.

Thornbury Analytics wants project leads to grant their own team members access to the project's resource group without opening tickets to the platform team. A project lead must be able to assign only the Reader and Contributor roles, must never be able to assign Owner or User Access Administrator, and must only hold the ability to manage access while an approved activation is in effect.

Which two actions should you recommend? Each correct answer presents part of the solution.

1. AAssign each project lead the Role Based Access Control Administrator role on their resource group with a condition that limits assignable roles to Reader and ContributorRole Based Access Control Administrator is the built-in role for delegating access management, and role assignment conditions can constrain which roles the delegate may assign, which is exactly the Reader and Contributor restriction.
2. BMake that assignment eligible in Privileged Identity Management with approval required for activationPIM makes the delegation just-in-time, so the lead can manage access only after an approved activation, satisfying the requirement that the capability is not standing.
3. CAssign each project lead the User Access Administrator role on the subscriptionUser Access Administrator at subscription scope lets the lead assign any role, including Owner, across every resource group.
4. DAssign each project lead the Owner role on their resource groupOwner can assign any role including Owner itself and also manages resources, exceeding what was asked.
5. ECreate a custom role containing Microsoft.Authorization/roleAssignments/write with no conditionsWithout a condition this permission allows assigning any role, so the Owner and User Access Administrator restriction is not enforced.

Mardell Health runs an internal timesheet web application on an IIS server in its own datacenter. Remote employees must reach it from managed devices with Microsoft Entra single sign-on, and Conditional Access policies must be evaluated before each session. The security team refuses to open any inbound firewall ports and does not want to deploy a VPN. The application uses Windows integrated authentication.

What should you recommend?

1. AAzure Front Door with the on-premises server as a backendFront Door requires the backend to be reachable from the internet, which means an inbound firewall rule, and it does not perform Entra pre-authentication with Kerberos delegation to the app.
2. BA point-to-site VPN gateway in Azure connected to the datacenterThe scenario rules out a VPN, and a VPN gives network access rather than per-application Entra authentication with Conditional Access.
3. CMicrosoft Entra application proxy with Kerberos constrained delegation to the IIS serverApplication proxy connectors make only outbound connections, users pre-authenticate against Entra ID where Conditional Access is applied, and the connector performs Kerberos constrained delegation to deliver single sign-on to a Windows integrated authentication app.
4. DAzure Bastion with a site-to-site link to the datacenterBastion provides RDP and SSH to VMs through the portal; it is not a published-application access path for web users.

Ashcombe Engineering collaborates with 40 supplier companies. Supplier engineers need to access an Ashcombe project portal hosted in Azure and several SharePoint sites. Suppliers must keep using their own corporate credentials, Ashcombe must not manage supplier passwords, and Ashcombe wants to apply its own Conditional Access MFA policies to supplier sign-ins. You must minimize administrative effort.

What should you recommend?

1. ACreate a Microsoft Entra ID account for each supplier engineer in the Ashcombe tenantAshcombe would then own and support thousands of passwords, which the scenario explicitly rules out.
2. BUse Microsoft Entra B2B collaboration to invite supplier engineers as guest users and apply Conditional Access to guestsB2B guests authenticate with their home organization's credentials while appearing in the Ashcombe directory, so Ashcombe can assign access and apply its own Conditional Access policies without managing supplier passwords.
3. CCreate a Microsoft Entra External ID customer tenant for suppliersA customer tenant is for consumer-style self-registered accounts and does not share the Ashcombe directory with Microsoft 365, so the SharePoint requirement and corporate credential reuse are not met.
4. DEstablish an Active Directory forest trust between Ashcombe and each supplierForest trusts require on-premises AD DS on both sides and network connectivity to 40 partners, and they do nothing for Entra-protected cloud apps or SharePoint Online.