Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the…

The proposed solution, using a Privileged Identity Management (PIM) role assignment with an approver from the same tenant (contoso.com), does not fully meet the goal. While it adds a layer of protection by requiring a second administrator's approval, it is insufficient to prevent a malicious actor who has compromised the contoso.com tenant. A sophisticated attacker could potentially compromise both the requesting administrator's account and the designated approver's account, or a compromised Global Administrator could reconfigure the PIM approval workflow. This single point of failure within the same security boundary (the contoso.com tenant) means the solution does not guarantee prevention.

A. Yes: This is incorrect because the solution fails to establish true separation of duties across different security or administrative domains. An approver within the same tenant is vulnerable to a tenant-wide compromise, thus not fully preventing the malicious action as required.

1. Microsoft Learn, "About multi-user authorization for Azure Backup." This document describes the recommended feature for this exact scenario. It states, "Multi-user authorization (MUA) for Azure Backup allows you to add an additional layer of protection to critical operations on your Recovery Services vaults... MUA ensures that any critical operation is performed with the authorization of two users." It achieves this using a Resource Guard in a separate subscription or tenant, creating the necessary security boundary that the proposed PIM solution lacks.

2. Microsoft Learn, "Approve or deny requests for Microsoft Entra roles in Privileged Identity Management." Section: "Approvers." This documentation details how PIM approval works. It shows that approvers are configured within the role settings. If the approver is another user within the same tenant, it does not protect against a scenario where the entire tenant's administrative accounts are at risk of compromise.

3. Microsoft Learn, "Azure Backup security features to help protect hybrid backups from attacks." Section: "Prevent attacks." This article explicitly discusses protecting against "rogue administrators" and recommends using Multi-User Authorization (MUA) with a Resource Guard as the primary mechanism to prevent unauthorized deletion of backups, highlighting that this is a stronger control than standard role-based access control configurations.