You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. You have an on-premises datacenter that contains 100…

To prevent a single compromised administrator account from deleting backups, the Microsoft Security Best Practice is to implement a separation of duties for critical operations. Multi-user authorization (MUA) using Resource Guard in Azure Backup is designed for this exact purpose. It ensures that destructive actions, such as deleting backups or reducing retention, require approval from a separate administrator who has permissions on the Resource Guard, which is typically managed by a different team. This prevents a single point of compromise from leading to data loss and is a core component of a ransomware recovery strategy.

A. The security PIN adds an extra authentication step, but it does not enforce separation of duties. A compromised administrator who has access to the Azure portal could still perform the destructive action.
C. Registering MABS with a Recovery Services vault is a standard configuration step required for backups to function; it does not provide any specific security protection against malicious deletion.
D. PIM provides just-in-time (JIT) access, which limits the time an account has elevated privileges. However, once the role is activated by the compromised user, they would have full permission to delete backups.

1. Microsoft Learn, "Multi-user authorization for Azure Backup using Resource Guard," Section: "About Multi-user authorization for Backup." This document states, "Multi-user authorization (MUA) for Azure Backup allows you to add an additional layer of protection to critical operations on your Recovery Services vaults... This provides maximum security for your backups, ensuring that even in a scenario of a rogue administrator, critical operations can be performed only after getting the required authorizations."

2. Microsoft Learn, "Backup and restore plan to protect against ransomware," Section: "Protect backups from attacks." This best practice guide explicitly recommends MUA: "To provide an additional layer of security before executing critical operations, Azure Backup provides multi-user authorization (MUA)... We highly recommend you enable MUA to provide enhanced protection for your backups."

3. Microsoft Learn, "Security features to help protect hybrid backups from attacks," Section: "Preventing attacks." This document lists both MUA and the security PIN as features. However, MUA with Resource Guard is presented as the more robust solution for preventing malicious actions by enforcing authorization from a separate principal.

4. Microsoft Learn, "What is Privileged Identity Management?," Section: "What does it do?". This document explains that PIM's purpose is to provide time-based and approval-based role activation to mitigate risks of excessive permissions, but it does not prevent an authorized (or compromised but activated) user from performing actions allowed by their role.