AZ-305 Practice Question: Design identity, governance, and monitoring solutions
A company uses Microsoft Entra ID. They want to grant a user temporary access to the Global Administrator role for a specific task. The access must require approval from a manager and automatically expire after 4 hours. Which Microsoft Entra ID feature should they use?
⚠ Common exam trap
Many exam-takers confuse PIM's JIT activation with Conditional Access policies, which control access to applications but not role elevation, or with Access Reviews, which are for periodic recertification rather than temporary activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Privileged Identity Management (PIM)
Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access, allowing users to activate roles like Global Administrator for a limited time. It supports approval workflows (manager approval) and configurable activation duration (e.g., 4 hours), making it the correct choice for temporary, approved, time-bound role elevation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Conditional Access
Why it's wrong here
Microsoft Entra ID Conditional Access is an access-decision engine that evaluates signals such as user location, device compliance, and risk during authentication to allow or block access, or to require multi-factor authentication. It does not provide just-in-time activation of privileged roles, nor does it assign temporary, expiring permissions to role members. Instead, it controls how access is granted at runtime based on policies, not whether a user can elevate to a specific admin role for a limited time. Therefore, while Conditional Access can enforce strong authentication for PIM activation, it cannot replace PIM's time-bound role elevation with approval.
- ✗
Microsoft Entra ID Identity Protection
Why it's wrong here
Microsoft Entra ID Identity Protection focuses on detecting identity risks, such as leaked credentials, impossible travel, or suspicious sign-in behavior, and automatically responds with remediation actions like requiring password reset or blocking sign-in. It does not manage role assignments or provide a mechanism for users to request temporary elevated privileges for Entra ID roles. Its purpose is to protect accounts from compromise and assess risk, not to delegate or time-limit administrative access. Because the requirement is about granting a user just-in-time role activation with approval and expiration, Identity Protection is not the correct service.
- ✓
Microsoft Entra ID Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it enables just-in-time, time-bound activation of privileged Entra ID roles. With PIM, you can make a user eligible for a role, and the user can activate it for a configured maximum duration, optionally requiring business justification and approval from designated approvers. Once the activation time expires, the role is automatically deactivated, so the user no longer has the elevated permissions. PIM also provides audit logs and access reviews, but its core value is exactly the time-limited, approval-based elevation scenario described in the requirement.
- ✗
Microsoft Entra ID Access Reviews
Why it's wrong here
Microsoft Entra ID Access Reviews is a governance tool used to periodically recertify existing access assignments, such as verifying that users still need their group memberships or role assignments. It does not support on-demand, just-in-time activation of roles, nor does it enforce temporary expiration of permissions after activation. Access Reviews generate a process for owners to approve or remove an individual's ongoing access, typically at scheduled intervals, rather than granting a user temporary elevated access for a specific task. Therefore, Access Reviews alone cannot fulfill the requirement for approval-based, expiring role activation.
Go deeper
Related to this question
About these practice questions
One of 212 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.