A security engineer needs to configure Microsoft Entra ID to prevent service accounts used by AI workloads from being modified or deleted by Azure subscription owners. The service accounts are represented as workload identities (service principals). Which Microsoft Entra ID feature prevents unauthorized modification of these service principals?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need administrative units to scope who can manage those AI workload service principals. Put the service principals in a restricted administrative unit and give management rights only to a designated security group, so subscription owners can't modify or delete them without that scoped role.
Full Explanation
The administrative units feature is correct because Microsoft Entra ID administrative units can be used to scope management permissions. By placing the AI workload service principals in a restricted administrative unit and granting management rights only to a specific designated security group, subscription owners without the appropriate administrative unit role cannot modify or delete those service principals. The role-assignable group approach is incorrect because assigning service principals to a role-assignable group only makes them eligible for role assignments; it does not lock the service principal objects or prevent subscription owners from modifying or deleting them. The Privileged Identity Management approach is incorrect because PIM for service principal management roles controls who can activate directory-level management roles, but does not restrict specific service principal objects from being modified by those who already have broad permissions. The Conditional Access approach is incorrect because Conditional Access policies apply to authentication events, not administrative modification operations on directory objects.