AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Entra ID Privileged Identity Management (PIM)

  Why it's wrong here

  Microsoft Entra ID Privileged Identity Management (PIM) is narrowly focused on privileged role activation, providing just-in-time, time-bound assignments for Microsoft Entra roles and Azure resource roles with approval and multi-factor authentication requirements. It does not govern ongoing access to general business resources such as groups, Teams, or SharePoint sites, nor does it manage the request-and-recertification lifecycle for regular employees or external partners.

• ✓

  Microsoft Entra ID Entitlement Management

  Why this is correct

  Microsoft Entra ID Entitlement Management is the correct choice because it creates access packages that bundle resources—groups, apps, SharePoint sites, and Teams—and define policies for who can request, who must approve, when access expires, and which access reviews are required. It automates the end-to-end lifecycle of access assignments and lets external partners request time-limited access through the Microsoft Entra admin center or a custom portal, satisfying both automation and periodic recertification.

• ✗

  Microsoft Entra ID Conditional Access

  Why it's wrong here

  Conditional Access is a real-time policy engine that evaluates signals during sign-in, such as user risk, device compliance, location, and application, to allow, block, or require stronger authentication (for example, MFA). It does not create or remove access assignments, enforce expiration, or drive periodic access reviews, so it cannot automate the lifecycle of who has access to a resource after authentication succeeds.

• ✗

  Microsoft Entra ID Identity Protection

  Why it's wrong here

  Identity Protection detects and responds to identity-based risk signals—like leaked credentials, impossible travel, or compromised sessions—and can trigger automated remediation such as requiring a secure password change or blocking sign-in. Its purpose is to protect identities from attacks, not to provision, assign, or recertify access to resources; therefore it does not address license or entitlement lifecycle management for partners.