SC-100: Microsoft Cybersecurity ArchitectDemo

Question

Your organization has a Microsoft 365 subscription with 1,000 users and a group named Group1. All users have Windows 11 devices and sign in using their Microsoft Entra accounts. The users do not have administrative rights on their devices.

Members of Group1 remotely assist the users by taking control of their sessions. These remote control sessions run in the security context of the user being assisted.

You need to recommend a solution that will:

Enable Group1 members to run apps that require administrative rights on the users' devices
Ensure the apps run in the context of each signed-in standard user

What should you include in the recommendation?

A Microsoft Entra Privileged Identity Management
B Microsoft Intune Endpoint Privilege Management
C Microsoft Entra entitlement management
D Windows Local Administrator Password Solution (Windows LAPS)

Explanation

Microsoft Intune Endpoint Privilege Management (EPM) allows administrators to define elevation rules for specific applications so that standard (non-admin) users can run those apps with elevated administrative rights, while the elevation is scoped to that application and executes in the context of the signed-in standard user rather than requiring a separate administrator account. This matches the requirement that apps run in the context of each signed-in standard user during remote-assistance sessions that operate under the user's own security context. Entra PIM provides just-in-time elevation for Entra/Azure directory roles, entitlement management automates access package requests/approvals for resources, and Windows LAPS manages local administrator account passwords — none of these enable per-app elevation for a standard user's own session.

Learn more

What is Endpoint Privilege Management? - Microsoft Intune

SC-100: Microsoft Cybersecurity ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ354

Community Discussion