AZ-900 Describe Azure management and governance Practice Question
Which Azure feature allows an organization to provide temporary, time-limited access to Azure resources without permanent role assignment?
⚠ Common exam trap
Many exam-takers confuse Azure Conditional Access (which controls authentication conditions) with Privileged Identity Management (which controls temporary role activation), or they assume Azure RBAC role assignments inherently support time limits, when in fact standard RBAC assignments are permanent unless explicitly removed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Privileged Identity Management
Azure Privileged Identity Management (PIM) is the correct answer because it provides just-in-time (JIT) privileged access to Azure resources, allowing organizations to grant time-bound, temporary permissions that automatically expire. Unlike permanent role assignments, PIM requires activation with approval, duration, and justification, ensuring least-privilege security without persistent access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Conditional Access
Why it's wrong here
Azure Conditional Access is an identity-driven policy engine that evaluates real-time signals such as user location, device compliance, and risk to decide whether to allow or block access to applications. It enforces access control conditions at the moment of sign-in, but it has no concept of temporary role elevation or time-limited expansion of an administrator's permissions. Because it does not manage privileged role activation or provide just-in-time (JIT) assignments, it cannot satisfy the requirement for time-limited role elevation.
- ✓
Azure Privileged Identity Management
Why this is correct
Azure Privileged Identity Management (PIM) delivers just-in-time privileged access for Azure Active Directory roles and Azure resource roles, enabling administrators to activate time-bound, elevated roles on demand. It supports approval workflows, multi-factor authentication, and automatic role expiration, after which the privileged role is deactivated. This precise, auditable mechanism directly matches the need for time-limited, just-in-time elevation of a user's role.
- ✗
Azure RBAC role assignment
Why it's wrong here
An Azure RBAC role assignment grants a principal a specific role (such as Owner or Contributor) that remains continuously in effect until the assignment is manually changed or removed. These standard assignments are static and have no built-in expiry, activation window, or approval step, meaning the principal holds the elevated permissions permanently. While RBAC defines the authorization model that PIM also leverages, a permanent RBAC assignment alone does not provide the temporary, just-in-time elevation described in the requirement.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a governance and compliance service that creates, enforces, and applies policies to ensure Azure resources conform to organizational rules, such as restricting resource locations or enforcing tagging. It evaluates resource configuration and can prevent non-compliant deployments, but it operates on resource properties, not on identity roles or permissions. Consequently, Azure Policy has no capability to provide time-limited role elevation and is unrelated to the requirement for just-in-time privileged access.
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.