AZ-305 Practice Question: Design identity, governance, and monitoring solutions
Your company uses Microsoft Entra ID. You need to implement a privileged identity management (PIM) strategy to secure administrative roles. Which TWO capabilities does PIM provide? (Choose two.)
⚠ Common exam trap
It's easy for candidates to confuse Conditional Access policies (which control access to apps) with PIM's role activation policies (which control access to privileged roles), leading them to incorrectly select Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Approval workflows for role activation
Privileged Identity Management (PIM) in Microsoft Entra ID provides time-based and approval-based role activation to secure privileged roles. Approval workflows for role activation (Option A) are a core PIM feature, allowing designated approvers to review and approve activation requests before a user gains elevated permissions. This ensures that privileged access is granted only after explicit authorization, reducing the risk of unauthorized use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Approval workflows for role activation
Why this is correct
PIM's approval workflows require designated approvers to approve an activation request before the role becomes active, adding human oversight to privileged access. Approvals are configured per role and support multi-stage approval via approver groups, with users able to provide justification. This gate prevents unauthorized or casual elevation, complementing time-bound eligibility.
- ✗
Conditional Access policies for role activation
Why it's wrong here
Conditional Access policies govern sign-in and session risk for accessing cloud apps, whereas PIM activation is controlled by internal activation rules such as MFA and approval, not by Conditional Access. PIM can enforce MFA on activation, but that is a PIM-specific setting, not a Conditional Access policy evaluation. Therefore, using Conditional Access policies to control role activation is conceptually incorrect.
- ✗
Management of external identities
Why it's wrong here
PIM governs privileged role assignments and activations for users already in your directory, whereas external partners are onboarded and managed through Entra External Identities (B2B collaboration). PIM does not manage the identity lifecycle of external users, such as invitations, claims mapping, or external tenant relationships. Thus, external identity management is outside PIM's scope.
- ✓
Just-in-time (JIT) access to privileged roles
Why this is correct
Just-in-time access lets users who are eligible for a privileged role activate it only when needed, for a limited, configurable duration. This eliminates persistent standing privileges, reducing attack surface. With optional justification, MFA, and approval checks, JIT activation is a core pillar of PIM and directly satisfies the requirement for time-bound access.
- ✗
Automated user provisioning to applications
Why it's wrong here
Automated user provisioning refers to creating, updating, and deleting user accounts in SaaS applications via the Entra ID provisioning service (often using SCIM), not PIM. PIM only controls activation and assignment of privileged roles within Microsoft Entra or Azure resources. It does not provision or de-provision user accounts in external applications, so that option is unrelated to privilege management.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 795 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.