AZ-500 Secure identity and access Practice Question
You are designing a privileged access strategy for Microsoft Entra ID. Your organization requires that all users who are assigned to the Global Administrator role must perform a privileged elevation only when needed, and the elevation must be approved by a security officer. Which feature should you implement?
⚠ Common exam trap
Candidates often confuse Conditional Access (which controls sign-in access) with PIM (which controls role activation), leading them to select Option C because they think session controls can enforce approval for elevation, but Conditional Access cannot manage role activation workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Identity Governance – Privileged Identity Management
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged elevation for roles like Global Administrator, requiring approval from designated approvers (e.g., a security officer) before activation. This directly meets the requirement of elevation only when needed with approval, as PIM manages time-bound role assignments and approval workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Identity Governance – Privileged Identity Management
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) delivers just-in-time privileged access by letting users activate eligible role assignments for a maximum time window, with optional approval workflows, MFA, and business justification. Because activation is time-bound and audited, PIM directly supports a privileged access strategy that requires temporary elevation with oversight.
- ✗
Azure AD administrative units
Why it's wrong here
Administrative units in Azure AD let you delegate administration by scoping role permissions to specific resources or segments of an organization, but they do not implement just-in-time activation. Roles assigned through administrative units can still be permanent or eligible, yet the unit itself provides no time-limited elevation, approval workflow, or activation request/approval cycle, so it cannot fulfill a JIT strategy by itself.
- ✗
Conditional Access with session control
Why it's wrong here
Conditional Access session controls, such as sign-in frequency, session lifetime, or app-enforced restrictions, govern security during an active user session but do not control when a user activates an elevated role. They cannot enforce time-bound role activation, approval steps, or MFA specifically for privileged identity elevation; session controls are a complementary protection layer, not a substitute for PIM.
- ✗
Microsoft Entra ID protection risk policies
Why it's wrong here
Microsoft Entra ID Protection risk policies evaluate sign-in risks and user risks to block or require password changes for compromised accounts, but they do not manage privileged role elevation. These policies address authentication-level threats, not the timing or authorization of JIT activation for high-privilege roles, so they are unrelated to the time-bound activation with approval required in this scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.