A company uses Microsoft Entra ID (Microsoft Entra ID). They need to grant specific IT administrators just-in-time (JIT) access to Azure virtual machines for troubleshooting. The access must be time-bound, require approval from a senior manager, and be automatically revoked after the granted time period. The company also needs an audit log of all access requests and assignments. Which Azure service or feature should they use?

Azure Bastion

Azure Bastion provides secure and seamless RDP/SSH connectivity to VMs directly in the Azure portal. It does not provide time-bound access with approval workflows.

Just-in-Time VM access (Microsoft Defender for Cloud)

This feature controls network access by locking down inbound ports until a request is approved. It does not manage identity-based RBAC roles or require manager approval for a specific user.

Microsoft Entra ID Application Proxy

Microsoft Entra ID Application Proxy enables secure remote access to on-premises web applications. It is not used for managing access to Azure VMs.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Microsoft Entra ID Privileged Identity Management (PIM) for Azure resources — Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time access to Azure resources, including virtual machines. It allows time-bound access with approval workflows and automatic expiration. Audit logs are built in. Azure Bastion provides secure RDP/SSH but does not manage access timing or approvals. Just-in-Time VM access in Microsoft Defender for Cloud is a similar feature but focuses on network access control, not identity-based RBAC with approvals. Microsoft Entra ID Application Proxy is for publishing on-premises apps.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.