Task 1.1: Secure access to resources by using Microsoft Entra ID

• AMake both the engineer and the managed identity eligible in PIM, and have the pipeline activate its role before each run

  Incorrect

  Eligible assignments can't be created for service principals or managed identities, because they can't perform the activation steps.

• BCreate the engineer's eligible assignment on the vault in PIM under Azure resources, and give the managed identity an active assignment

  Correct

  PIM can create eligible assignments at resource scope, which the IAM page can't, and a managed identity can't perform activation, so it needs an active assignment.

• CCreate the engineer's eligible assignment on the resource group's IAM page, where the Eligible type is offered

  Incorrect

  The IAM page offers eligible assignments at resource group scope, but the role would then cover every vault in the group.

• DGive the engineer a permanent active assignment on the vault and require MFA for Azure management in Conditional Access

  Incorrect

  A permanent active assignment is standing access; the engineer would never need to activate the role.

With PIM, the Access control (IAM) page can create eligible assignments at management group, subscription and resource group scope, but not at resource scope, so an eligible assignment on a single vault is made in PIM. Eligible assignments are for users: applications, service principals and managed identities can't perform the activation steps, so the pipeline's identity gets an active assignment.

• AChange the grant control to require multifactor authentication for the service principal

  Incorrect

  A service principal can't do MFA; for workload identities, Block access is the only grant option.

• BTarget Microsoft Graph instead of All resources, because All resources skips app-only tokens

  Incorrect

  All resources is the documented target, and the policy applies whenever the service principal requests a token.

• CReplace Billing-Export with a user-assigned managed identity so that the policy covers it

  Incorrect

  Managed identities aren't covered by Conditional Access policies at all.

• DAssign Billing-Export to the policy directly as a selected service principal

  Correct

  A policy assigned to a group that contains a service principal isn't enforced for it; the service principal must be assigned directly as a workload identity.

Conditional Access for workload identities applies to single-tenant service principals registered in your tenant and needs Workload Identities Premium licenses. Service principals can be group members, but a policy assigned to such a group isn't enforced for them: include the service principal itself under Select service principals. Block access is the only grant control, and managed identities are out of scope.

• ARun the job as the VM's managed identity, with a role on the resource group

  Correct

  Workload identities such as managed identities aren't affected by mandatory MFA, and the VM gets their tokens without a stored credential.

• BRegister a FIDO2 passkey for svc-deploy and keep the security key plugged in to the VM

  Incorrect

  Completing a passkey sign-in needs a person, so the job couldn't run unattended.

• CChange the job to use only Get cmdlets, which mandatory MFA doesn't cover

  Incorrect

  Read operations don't require MFA, but the job has to create and delete resources.

• DCreate an app registration and keep its client secret in the file instead of the password

  Incorrect

  A client secret in a file is still a credential stored on the VM, which security forbids.

Phase 2 of mandatory MFA, from October 1, 2025, requires MFA for Azure CLI, Azure PowerShell, IaC tools and REST calls that create, update or delete resources. User accounts used as service accounts must then complete MFA; Microsoft recommends moving them to workload identities, which neither phase affects. A managed identity on the VM needs no stored secret.

• ADeactivate the app's registration under App registrations

  Incorrect

  The app registration lives in the publisher's tenant, so you can't deactivate it from yours.

• BSet Enabled for users to sign in to No in the app's enterprise application properties

  Correct

  This sets the service principal's accountEnabled to false, which prevents all tokens from being issued for the app while keeping its configuration.

• CDelete the app's enterprise application

  Incorrect

  Deleting removes the enterprise application from use instead of keeping its configuration in place for the investigation.

• DRevoke the admin-consented permissions on the app's Permissions page

  Incorrect

  Revoking removes the granted permissions that must stay in place, and it doesn't stop the app from signing users in.

Disabling user sign-in for an enterprise application sets its service principal's accountEnabled property to false in your tenant, so no tokens are issued for the app; the configuration stays and the Activation status shows Deactivated. Deactivating the app registration disables the app across all tenants, but only the home tenant can do that.

• AAn engineer signing in to Azure CLI

  Correct

  Azure CLI is one of the services grouped under this resource.

• BAn engineer running Microsoft Graph PowerShell to list users

  Incorrect

  Microsoft Graph PowerShell calls Microsoft Graph, which this resource doesn't cover.

• CAn engineer signing in to Azure DevOps

  Incorrect

  Policies on this resource no longer cover Azure DevOps.

• DAn engineer running Azure PowerShell cmdlets against Azure Resource Manager

  Correct

  The resource applies to Azure PowerShell, which calls the Azure Resource Manager API.

• EA pipeline's managed identity calling Azure Resource Manager

  Incorrect

  Managed identities aren't covered by Conditional Access policies.

Targeting Windows Azure Service Management API enforces the policy for tokens issued to services closely bound to the portal, including Azure Resource Manager, Azure CLI and Azure PowerShell. It doesn't apply to Microsoft Graph PowerShell or Azure DevOps, and Conditional Access never evaluates managed identities.

• ASplit the credentials across two identities, since one identity holds at most two

  Incorrect

  An identity can hold up to 20 federated credentials.

• BCreate the credentials one after another, for example with dependsOn

  Correct

  Concurrent creation under one user-assigned identity triggers conflict detection, so they must be created sequentially.

• CAdd the same subject to all four credentials

  Incorrect

  The issuer and subject combination must be unique on the identity.

• DGrant the deployment identity Managed Identity Operator

  Incorrect

  The failure comes from concurrent updates, not missing permissions.

Creating multiple federated identity credentials under the same user-assigned managed identity at the same time causes 409 conflict failures. Create them sequentially: set a loop to serial mode or chain them with dependsOn. Credentials under different identities can be created in parallel.

• AGet-AzRoleAssignment

  Incorrect

  That lists role assignments without their eligibility schedules.

• BGet-AzRoleAssignmentSchedule

  Incorrect

  That lists active assignment schedules, such as active time-bound assignments.

• CGet-AzRoleEligibilitySchedule

  Correct

  It returns eligible role assignments for the scope.

• DGet-AzRoleDefinition

  Incorrect

  That lists role definitions, not who is eligible for them.

No single PowerShell command lists both eligible and active time-bound assignments. Get-AzRoleEligibilitySchedule lists eligible assignments, and Get-AzRoleAssignmentSchedule lists active assignments, which you can filter to those with an end date.

• A30 days after deletion

  Correct

  Soft-deleted enterprise applications can be restored within the first 30 days.

• B7 days after deletion

  Incorrect

  The restore window is longer than a week.

• C90 days after deletion

  Incorrect

  The application is hard deleted well before that.

• DIt can't be restored; it must be added again

  Incorrect

  A deleted enterprise application stays in a suspended state and can be restored.

A deleted enterprise application remains in a suspended state in the recycle bin for 30 days, during which it can be restored; after that it's permanently deleted. Microsoft suggests considering deactivation before deletion when you need to keep the configuration.

• AThe resource owner must rotate a client secret every 90 days

  Incorrect

  Managed identities don't use client secrets that anyone rotates.

• BKey Vault rotates a key for the identity on a schedule you set

  Incorrect

  The credential isn't stored in or rotated by your key vault.

• CThe credential never expires, because tokens are issued by IMDS

  Incorrect

  IMDS hands out tokens, but the underlying credential expires.

• DAzure uses a certificate that expires after 90 days and rolls it after 45 days

  Correct

  Managed identities use certificate-based authentication managed by Azure.

Managed identities use certificate-based authentication. Each identity's credential expires after 90 days and is rolled after 45 days, without any action by the resource owner.