The answer is Privileged Identity Management (PIM). This Microsoft Entra feature is the correct choice because it provides just-in-time privileged access with an approval workflow, allowing you to require a business justification for activation, designate a separate group of approvers, and enforce a maximum activation duration of 4 hours—all conditions specified in the scenario. On the MS-102 exam, this question tests your ability to distinguish PIM from other Entra features like Identity Protection or Access Reviews; a common trap is confusing PIM with Privileged Access Groups, but remember that PIM specifically handles role-based activation with approval and time-bound expiry. For a quick memory tip, think “PIM = Permission In Minutes” with approval gates, ensuring Global Administrator access is both temporary and audited.
MS-102 Practice Question: Implement and manage identity and access in Microsoft Entra ID
This MS-102 practice question tests your understanding of implement and manage identity and access in microsoft entra id. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security administrator needs to implement a just-in-time (JIT) privileged access solution for the Global Administrator role. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should be configured?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Conditional Access
Why it's wrong here
Conditional Access policies enforce access controls based on conditions but do not provide JIT role activation or approval workflows.
✓
Privileged Identity Management (PIM)
Why this is correct
PIM enables time-bound role activation with approval, justification, and automatic deactivation.
Related concept
Read the scenario before looking for a memorised answer.
✗
Azure AD Roles (default role settings)
Why it's wrong here
Default Azure AD role assignments are permanent or group-based, not JIT with approval.
✗
Identity Protection
Why it's wrong here
Identity Protection detects risks like leaked credentials and suspicious sign-ins, not role activation.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Conditional Access (which controls access to apps) with PIM (which controls privileged role activation), or they assume default role settings can enforce JIT activation without realizing that PIM is the only feature that provides time-bound, approval-based role elevation.
Detailed technical explanation
How to think about this question
PIM uses Azure AD's role-based access control (RBAC) with a time-bound activation model: when a user activates a role, PIM temporarily adds the user to the role's membership for the specified duration (up to the maximum set by the administrator). The approval workflow leverages Azure AD's approval APIs and can send email notifications to approvers; the activation request includes a justification field that is logged in the Azure AD audit logs for compliance. In a real-world scenario, an organization might set a 4-hour maximum activation for Global Administrator to limit exposure, while requiring a separate security team to approve each request via the PIM portal or Microsoft Entra admin center.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Implement and manage identity and access in Microsoft Entra ID — This question tests Implement and manage identity and access in Microsoft Entra ID — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Privileged Identity Management (PIM) — Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?
medium
✓ A.Privileged Identity Management (PIM)
B.Identity Protection
C.Conditional Access
D.Access Reviews
Why A: Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.
Variation 2. A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?
hard
✓ A.Edit the role settings of the Global Administrator role in PIM.
B.Create an access review for the Global Administrator role.
C.Configure Azure AD Identity Protection to require MFA for Global Administrator.
D.Assign the Global Administrator role directly to the users temporarily.
Why A: Option A is correct because the requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.
Variation 3. The security team wants to require approval for any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM). The approvers must be members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify?
medium
A.Role settings for Global Administrator: require approval, set maximum activation duration to 4 hours, and require justification
B.Role settings for Global Administrator: require MFA, set maximum activation duration to 4 hours, and require justification
C.In the eligible assignments for Global Administrator, add 'GA-Approvers' as approvers
✓ D.Both A and C
Why D: Option D is correct because configuring PIM role settings for Global Administrator requires both enabling approval (with the 'GA-Approvers' group as designated approvers) and setting the activation parameters (maximum duration of 4 hours and justification requirement). Option A alone only sets the role settings but does not specify which group serves as approvers; Option C alone adds the approvers group but does not configure the activation duration or justification. Both A and C together fulfill the full requirement.
Variation 4. A company uses Azure AD Privileged Identity Management (PIM) for role activation. They want to require that any activation of the Security Administrator role be approved by a designated group of approvers called 'Security Approvers'. Activations must include a ticket number and expire after 8 hours. Which PIM configuration should the administrator modify?
medium
✓ A.Role settings for Security Administrator
B.Role assignments for Security Administrator
C.Access reviews for Security Administrator
D.Alerts for Security Administrator
Why A: Option A is correct because Azure AD PIM role settings for a specific role, such as Security Administrator, control activation requirements including approval workflow, justification (ticket number), and maximum activation duration. By modifying the role settings, the administrator can require approval from the 'Security Approvers' group, mandate a ticket number, and set an 8-hour expiration.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.