hardMultiple ChoiceObjective-mapped
MS-102 Practice Question: A company uses Microsoft Entra ID P2 licenses and…
A company uses Microsoft Entra ID P2 licenses and wants to implement just-in-time (JIT) privileged access for administrators. Security requirements state that Global Administrator role members must request approval and provide a business justification before their role activation expires after 4 hours. Which Microsoft Entra feature should be configured?
⚠ Common exam trap
Test-takers frequently confuse Conditional Access with PIM because both involve 'access control,' but Conditional Access cannot enforce time-bound role activation with approval and justification workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, requiring approval and a business justification for role activation, with configurable maximum activation durations (e.g., 4 hours). This directly meets the security requirement for Global Administrator role members to request approval and provide justification before activation expires after 4 hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies evaluate signals such as user risk, device compliance, and location at sign-in to allow or block sessions, but they act only on authentication events, not on the lifecycle of privileged role assignments. They cannot trigger a just-in-time (JIT) activation workflow, require approval from specific approvers, or set an expiration time for an elevated role session. Those role-activation controls are exclusively managed by PIM, making Conditional Access insufficient for the stated requirement.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time (JIT) activation of Azure AD roles, allowing eligible members to request elevated access with a defined start time, duration, and justification. Administrators can configure PIM to require approval from designated approvers before the role becomes active, ensuring every privileged activation is audited and time-boxed. This directly fulfills the scenario’s requirement for managed, approval-based, and time-limited privileged role activation. No other Entra ID feature combines role assignment, approval workflow, and expiration in this way.
- ✗
Identity Protection
Why it's wrong here
Identity Protection uses machine learning to detect anomalies and risk events such as impossible travel, leaked credentials, or risky sign-in behavior, and can automate responses like requiring MFA, blocking sign-ins, or forcing password changes. While it strengthens security at the user-authentication level, it does not manage how a user obtains a privileged role or approve the activation of such a role. Elevated role access is entirely outside its scope, so it cannot provide the approval or time-limited activation the company wants.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) allows end users to reset or unlock their own passwords without administrator intervention, using verification methods such as authentication apps, SMS, or security questions. This capability reduces helpdesk load and improves user autonomy, but it has no relationship to privileged role assignments or elevated access. It does not approve role activation requests nor enforce time limits on privileged sessions, making it completely irrelevant to the just-in-time (JIT) requirement described in the scenario.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.