Explanation:
Box 1: Azure AD Privileged Identity Management
Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:
- Provide just-in-time privileged access to Azure AD and Azure resources
- Assign time-bound access to resources using start and end dates
- Require approval to activate privileged roles
- Enforce multi-factor authentication to activate any role
- Use justification to understand why users activate
- Get notifications when privileged roles are activated
- Conduct access reviews to ensure users still need roles
- Download audit history for internal or external audit
- Prevents removal of the last active Global Administrator role assignment Box 2: Azure Managed Identity Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication. Applications may use the managed identity to obtain Azure AD tokens. With Azure Key Vault, developers can use managed identities to access resources. Key Vault stores credentials in a secure manner and gives access to storage accounts.
Box 3: Azure AD Privileged Identity Management
Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:
- Provide just-in-time privileged access to Azure AD and Azure resources
- Assign time-bound access to resources using start and end dates
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim- configure
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure- resources/overview

Explanation:
Box 1: Workspace replication
Enhance resilience by replicating your Log Analytics workspace across regions Replicating your Log Analytics workspace across regions enhances resilience by letting you switch over to the replicated workspace and continue operations if there's a regional failure Box 2: Availability zones Availability zones are physically separate groups of datacenters within each Azure region. When one zone fails, services can fail over to one of the remaining zones.
Availability zones works within a single region.
Azure App Service can be configured as zone redundant, which means that your resources are spread across multiple availability zones. Spreading across multiple zones helps your production workloads achieve resiliency and reliability. When you configure zone redundancy on App Service plans, all apps that use the plan are made zone redundant.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication
https://learn.microsoft.com/en-us/azure/architecture/web-apps/guides/enterprise-app- patterns/reliable-web-app/dotnet/guidance
https://learn.microsoft.com/en-us/azure/reliability/reliability-app-service?pivots=free-shared-basic

Service Bus is a transactional message broker and ensures transactional integrity for all internal operations against its message stores. All transfers of messages inside of Service Bus, such as moving messages to a dead-letter queue or automatic forwarding of messages between entities, are transactional.
Reference:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-transactions

Explanation:
Box 1: Azure Event Hubs
You can route Azure Active Directory (Azure AD) activity logs to several endpoints for long term retention and data insights.
The Event Hub is used for streaming.
Box 2: Azure Function
Use an Azure Function along with a cosmos DB change feed, and store the data in Cosmos DB.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-activity-logs- azure-monitor