A security team needs to implement Microsoft Entra Permissions Management (CIEM) to identify and remediate over-privileged AI service identities across their Azure subscriptions. After a permissions discovery scan, the team finds several managed identities with unused permissions. Which Permissions Management action remediates over-privileged identities while maintaining operational continuity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Microsoft Entra Permissions Management (CIEM) collects and analyzes actual permission usage data, then provides right-sizing recommendations that assign only the permissions that have actually been used by the identity. The right-size feature generates optimized role assignments that maintain operational continuity (no previously used permissions are removed) while removing unused over-privileges.
Full explanation below image
Full Explanation
B is correct because Microsoft Entra Permissions Management (CIEM) collects and analyzes actual permission usage data, then provides right-sizing recommendations that assign only the permissions that have actually been used by the identity. The right-size feature generates optimized role assignments that maintain operational continuity (no previously used permissions are removed) while removing unused over-privileges. A is incorrect because deleting and recreating identities risks operational disruption if any granted permissions are actually in use, even if infrequently. C is incorrect because Conditional Access policies apply to authentication and cannot restrict specific resource-level permissions that a managed identity has through RBAC. D is incorrect because PIM for managed identity role assignments is not a generally available feature; PIM applies to human user role activations, and even if available, it would change the operational model rather than right-sizing permissions.