A security engineer needs to configure Microsoft Entra ID to prevent service accounts used by AI workloads from being modified or deleted by Azure subscription owners. The service accounts are represented as workload identities (service principals). Which Microsoft Entra ID feature prevents unauthorized modification of these service principals?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because Microsoft Entra ID administrative units can be used to scope management permissions. By placing the AI workload service principals in a restricted administrative unit and granting management rights only to a specific designated security group, subscription owners without the appropriate administrative unit role cannot modify or delete those service principals.
Full explanation below image
Full Explanation
D is correct because Microsoft Entra ID administrative units can be used to scope management permissions. By placing the AI workload service principals in a restricted administrative unit and granting management rights only to a specific designated security group, subscription owners without the appropriate administrative unit role cannot modify or delete those service principals. B is incorrect because PIM for service principal management roles controls who can activate directory-level management roles, but does not restrict specific service principal objects from being modified by those who already have broad permissions. A is incorrect because there is no 'Protected Group' concept in Entra ID that prevents modification of service principals. C is incorrect because Conditional Access policies apply to authentication events, not administrative modification operations on directory objects.