Helpdesk engineers occasionally need local administrator rights on Azure Virtual Desktop session hosts to troubleshoot issues. You must meet these requirements: provide just-in-time, time-bound elevation for helpdesk engineers, and ensure each session host’s built-in local Administrator account has a unique, automatically rotated password backed up to Microsoft Entra ID. Which two actions should you implement? Each correct answer presents part of the solution.

Windows LAPS (Local Administrator Password Solution) configured in Intune with backup to Microsoft Entra ID directly addresses the requirement for unique, automatically rotated local Administrator passwords. This ensures security by preventing password reuse and provides a recovery mechanism. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time, time-bound elevation for helpdesk engineers. By making a security group eligible for PIM activation and then adding that group to the local Administrators group on session hosts via an Intune policy, engineers gain temporary administrative access only when needed. Assigning the Virtual Machine Administrator Login role is for Azure RBAC, not local admin rights. Adding the group to the master image grants permanent access, not just-in-time. Just-In-Time VM access in Defender for Cloud is for network access, not local admin rights.