AZ-900 Describe Azure management and governance Practice Question
Which Azure feature helps organizations maintain compliance by managing and auditing privileged access to Azure resources using just-in-time access?
⚠ Common exam trap
Watch out — candidates often confuse Azure RBAC (which defines what permissions are possible) with PIM (which controls when and how those permissions are activated), leading candidates to pick Azure RBAC because it is associated with roles, even though it lacks the JIT and auditing features required by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, enabling organizations to grant time-bound, approval-based roles that reduce standing admin privileges. PIM also generates audit logs for all activations and deactivations, directly supporting compliance requirements by ensuring privileged access is managed and auditable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC
Why it's wrong here
Azure RBAC is Azure's authorization system for controlling access to Azure resources, where permissions are granted via role assignments that bind a security principal to a role definition over a given scope, such as a subscription or resource group. These assignments are generally standing, meaning the user continuously holds those permissions until the assignment is changed. RBAC lacks just-in-time activation, approval workflows, and activation-specific audit trails, whereas PIM adds temporary activation and oversight for elevated roles.
- ✗
Azure AD Conditional Access
Why it's wrong here
Conditional Access is a policy engine that evaluates signals such as the user's identity, location, device compliance, and sign-in risk to enforce controls like multifactor authentication or blocking access. While it can restrict access based on conditions, it does not manage the activation lifecycle of privileged directory roles, nor does it provide role-specific, time-bound activation with approval workflows. PIM is specifically designed to handle just-in-time privileged role activation in Azure AD.
- ✓
Azure AD Privileged Identity Management (PIM)
Why this is correct
PIM provides just-in-time privileged access by allowing users to activate eligible Azure AD or Azure resource roles for a limited, configurable duration, with optional approval workflows, justification, and full audit logging. This eliminates standing privileges because administrators do not permanently hold high-privilege roles; instead, they request activation only when needed. PIM also can enforce MFA during activation and generate alerts for suspicious activity, making it the correct answer for time-bound privileged access with oversight.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a cloud service used to securely store and manage secrets, cryptographic keys, and certificates consumed by applications and services. Access to Key Vault is controlled through its own access policies or Azure RBAC, but those permissions only determine who can read or manage the vault's objects, not who can become a Global Administrator or activate an elevated role. PIM, in contrast, governs the eligibility and activation of privileged identity roles themselves, so Key Vault addresses data protection rather than identity governance.
Go deeper
Related to this question
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.