Manage identity and access →hardMultiple ChoiceObjective-mapped

AZ-500 Manage identity and access Practice Question

An organization uses Microsoft Defender for Cloud. They want to implement just-in-time (JIT) VM access for a set of production VMs. However, the security team needs to ensure that JIT access requests are always approved by a manager before opening ports. Which configuration should they use?

⚠ Common exam trap

It's easy for candidates to confuse Azure AD PIM (which manages role activation) with JIT VM access (which manages network port openings), leading candidates to incorrectly select PIM for VM-level access control.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enable JIT and configure a custom workflow automation with an approval step

Microsoft Defender for Cloud's JIT VM access can be integrated with a custom workflow automation that includes an approval step. This allows the security team to enforce manager approval before ports are opened, meeting the requirement for a formal approval process. The workflow automation can trigger an Azure Logic App or other action that requires a designated approver to authorize the request.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enable JIT in Defender for Cloud and configure a logic app to send approval emails
Why it's wrong here
Sending an approval email via a Logic App is only a notification and does not block or delay the JIT request. In Microsoft Defender for Cloud, a JIT policy opens the requested ports automatically unless the Logic App is designed with an explicit approval action (e.g., using the Approvals connector) that pauses execution until an approver responds. Without that approval step, the email alone never acts as a gate, so the workflow fails to meet the requirement for formal approval.
✗
Use Azure AD Privileged Identity Management (PIM) for JIT activation
Why it's wrong here
Azure AD Privileged Identity Management (PIM) provides just-in-time activation for Azure AD roles and Azure resource roles (control plane), but it does not manage virtual machine network access. Defender for Cloud's JIT VM feature works by creating temporary NSG rules to control inbound RDP/SSH traffic, which is a data-plane/network-layer mechanism outside PIM's scope. PIM cannot open or close ports, so it cannot serve as the JIT access control for VMs.
✓
Enable JIT and configure a custom workflow automation with an approval step
Why this is correct
The correct approach is to enable Defender for Cloud's JIT VM access and then create a custom workflow automation rule that triggers an Azure Logic App containing an approval step. The Logic App can use an approval connector (e.g., Send approval request through email or Teams) to pause the workflow until a manager or security officer approve or rejects the request. Only after approval does the Logic App signal Defender for Cloud to apply the JIT policy and open the requested ports, thereby enforcing a true approval gate before network access is granted.
✗
Use Conditional Access with session controls
Why it's wrong here
Conditional Access with session controls is designed for cloud applications (like Office 365 or custom SaaS apps) and applies evaluation through Azure AD for sign-in and session policies. It cannot control or restrict raw network-level protocols such as RDP or SSH to virtual machines, because those connections do not pass through Azure AD. Therefore, Conditional Access is fundamentally unsuited for JIT VM access, which requires network-specific security controls like NSG rules.

Go deeper

AZ-500 Manage identity and access Practice Question

Why each option matters

Option-by-option breakdown

Related to this question