A company uses Microsoft Entra ID Privileged Identity Management (PIM) to control access to administrator roles. They want to implement a monitoring solution that sends an email to the security team whenever a user activates the Global Administrator role outside of standard business hours (9 AM–5 PM). They also need to track all activation history for quarterly audits. Which solution should they implement?

Use Microsoft Entra ID Identity Protection to detect risky activations and trigger a Logic App

Identity Protection is designed for risky sign-ins and user risk, not specifically for PIM role activations.

Enable Microsoft Entra ID diagnostic settings to send logs to Event Hubs and process with Azure Stream Analytics

Event Hubs and Stream Analytics can process logs, but this is an over-engineering; simpler log analytics alert is sufficient.

Use Azure Sentinel with a built-in connector for PIM and create a scheduled analytics rule

Azure Sentinel can do this, but it is a more complex and expensive SIEM; the requirement does not indicate need for full SIEM.

What does this AZ-305 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Configure PIM to send notifications for role activations and stream PIM audit logs to Azure Log Analytics, then create an alert rule for activations outside business hours — The required integration involves streaming PIM audit logs (via Microsoft Entra ID diagnostic settings) to a Log Analytics workspace, then creating an Azure Monitor alert rule that triggers when a Global Administrator activation occurs outside the defined hours. This allows custom notifications and retains logs for auditing. PIM notifications alone cannot filter by time. Azure Sentinel could be used but is more complex and costlier for this scenario. Logic Apps with Event Hubs is an alternative but not the standard approach.

What should I do if I get this AZ-305 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.