AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?
⚠ Common exam trap
Many exam-takers confuse Just-in-Time VM access in Microsoft Defender for Cloud (which is network-level JIT) with PIM for Azure resources (which is role-level JIT), but only PIM supports the required approval workflow and audit logging for role assignments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources
Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources provides just-in-time (JIT) access with time-bound activation, approval workflows, and automatic revocation. It also includes full audit logging of all requests and assignments, meeting all the specified requirements for granting temporary access to Azure VMs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Bastion
Why it's wrong here
Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH connectivity to virtual machines directly in the Azure portal over TLS, without exposing public IP addresses. However, it only handles the network transport layer: any user who already has valid credentials can connect at any time, and it offers no time-bound activation, approval workflows, automatic revocation, or role-based elevation. Since the requirement calls for just-in-time, manager-approved access with an audit trail, Bastion cannot satisfy those identity and governance controls.
- ✓
Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources
Why this is correct
Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources is the correct choice because it activates RBAC roles, such as Virtual Machine Administrator Login or Contributor, just-in-time with a configurable maximum duration (typically 1–8 hours). Activation can require justification, multi-factor authentication, and an explicit approval from a designated manager or approver, and the role is automatically deactivated when the time window expires. Every activation and action is logged in the Microsoft Entra audit log, providing a complete and auditable record of who accessed what, when, and for how long.
- ✗
Just-in-Time VM access (Microsoft Defender for Cloud)
Why it's wrong here
Just-in-Time VM access in Microsoft Defender for Cloud is a network security feature that creates temporary NSG rules to allow inbound RDP/SSH traffic from a specific IP address for a user-requested time window. It does not manage identity, RBAC, or other roles for the VM itself; users still authenticate with their normal credentials, and approval is typically automatic through a policy rather than a manager-approval step. Therefore, it protects the network port but does not meet the requirement for time-bound role-based elevation with an explicit manager approval and full identity audit trail.
- ✗
Microsoft Entra ID Application Proxy
Why it's wrong here
Microsoft Entra ID Application Proxy is a reverse proxy that publishes on-premises web applications to remote users through the Microsoft Entra cloud, using a lightweight connector installed on the corporate network. Authentication is delegated to Microsoft Entra ID, but the service only exposes web apps via HTTP/S; it has no ability to grant or revoke time-bound RBAC roles for Azure VMs, nor does it provide an approval workflow for privileged access. Because the scenario involves Azure VM role authorization rather than web application publishing, Application Proxy is irrelevant.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.