mediumMultiple ChoiceObjective-mapped
MS-102 Practice Question: Implement just-in-time (JIT) privileged access…
A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?
⚠ Common exam trap
Candidates often confuse PIM's JIT activation with Conditional Access policies, thinking that Conditional Access can enforce time-based access, but Conditional Access cannot manage role activation, approval workflows, or expiration of privileged roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management (PIM) provides just-in-time activation for Azure AD roles and Azure resources, allowing administrators to activate eligible roles for a limited time, usually with approval from designated approvers and a business justification. This is the core mechanism for JIT privileged access because it directly addresses the need for on-demand, time-bound, and audited elevation in contrast to standing access. PIM also offers multi-factor authentication enforcement and audit logs to monitor activations.
- ✗
Identity Protection
Why it's wrong here
Identity Protection is not designed for privileged access management; it analyzes signals to detect sign-in risks and user risks, such as anonymous IP addresses or leaked credentials, and can trigger policies like MFA challenges or password resets. While it can be used to conditionally block high-risk admins during sign-in, it does not offer a workflow to activate or approve role assignments. It is a risk engine, not a role management or elevation workflow.
- ✗
Conditional Access
Why it's wrong here
Conditional Access is a policy engine that evaluates sign-in context (user, location, device compliance, risk) to allow or block access or require additional controls such as MFA, but it operates at the authentication layer, not on role activation. It cannot dynamically grant or activate a privileged role for a specific task or require an approval workflow for elevation. Although Conditional Access can enforce strong authentication for privileged roles, it is not a substitute for JIT activation, which PIM uniquely provides.
- ✗
Access Reviews
Why it's wrong here
Access Reviews are designed to provide periodic recertification of existing access assignments by requiring owners or reviewers to confirm that a user still needs a role, thereby helping to remove stale or excessive access. They are a governance and compliance control that runs on a schedule, not an on-demand activation mechanism. Access Reviews can complement PIM by reviewing eligible assignments, but they cannot activate a role just-in-time or enforce approval workflows for elevation.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.