mediumMultiple ChoiceObjective-mapped
Just-in-Time Privileged Access for Global Administrator with Approval
A security administrator needs to implement a just-in-time (JIT) privileged access solution for the Global Administrator role. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should be configured?
Quick Answer
The answer is Privileged Identity Management (PIM). This Microsoft Entra feature is the correct choice because it provides just-in-time privileged access with an approval workflow, allowing you to require a business justification for activation, designate a separate group of approvers, and enforce a maximum activation duration of 4 hours—all conditions specified in the scenario. On the MS-102 exam, this question tests your ability to distinguish PIM from other Entra features like Identity Protection or Access Reviews; a common trap is confusing PIM with Privileged Access Groups, but remember that PIM specifically handles role-based activation with approval and time-bound expiry. For a quick memory tip, think “PIM = Permission In Minutes” with approval gates, ensuring Global Administrator access is both temporary and audited.
⚠ Common exam trap
Watch out — candidates often confuse Conditional Access (which controls access to apps) with PIM (which controls privileged role activation), or they assume default role settings can enforce JIT activation without realizing that PIM is the only feature that provides time-bound, approval-based role elevation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed for just-in-time (JIT) privileged access. It allows you to configure role activation with approval workflows, require a business justification, set a maximum activation duration (e.g., 4 hours), and designate specific approvers. This directly matches all requirements in the question.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies enforce access controls based on conditions but do not provide JIT role activation or approval workflows.
- ✓
Privileged Identity Management (PIM)
Why this is correct
PIM enables time-bound role activation with approval, justification, and automatic deactivation.
- ✗
Azure AD Roles (default role settings)
Why it's wrong here
Default Azure AD role assignments are permanent or group-based, not JIT with approval.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects risks like leaked credentials and suspicious sign-ins, not role activation.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to implement just-in-time (JIT) privileged access for the Global Administrator role in Microsoft Entra ID. Users must request activation and provide a business justification. The request must be approved by a separate group of approvers, and the role activation should expire after 4 hours. Which Microsoft Entra feature should the administrator configure?
medium- ✓ A.Privileged Identity Management (PIM)
- B.Identity Protection
- C.Conditional Access
- D.Access Reviews
Why A: Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator with a business justification, requiring approval from a designated group of approvers, and setting a configurable activation duration (e.g., 4 hours). This directly matches the company's requirements for time-bound, approved role activation.
Variation 2. A company wants to require approval for any activation of the Global Administrator role in Privileged Identity Management (PIM). The approvers are predefined as members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify to meet these requirements?
hard- ✓ A.Edit the role settings of the Global Administrator role in PIM.
- B.Create an access review for the Global Administrator role.
- C.Configure Azure AD Identity Protection to require MFA for Global Administrator.
- D.Assign the Global Administrator role directly to the users temporarily.
Why A: The requirement to require approval, enforce a business justification, and set a 4-hour expiration for Global Administrator activations is configured in the role settings of the Global Administrator role within Privileged Identity Management (PIM). These settings control activation parameters such as approval requirements, justification, and maximum activation duration, which directly map to the stated needs.
Variation 3. The security team wants to require approval for any activation of the Global Administrator role in Azure AD Privileged Identity Management (PIM). The approvers must be members of a security group named 'GA-Approvers'. Activations must require a business justification and expire after 4 hours. Which PIM configuration should the administrator modify?
medium- ✓ A.Role settings for Global Administrator: require approval, set maximum activation duration to 4 hours, and require justification
- B.Role settings for Global Administrator: require MFA, set maximum activation duration to 4 hours, and require justification
- C.In the eligible assignments for Global Administrator, add 'GA-Approvers' as approvers
- D.Both A and C
Why A: To fulfill the requirements, the administrator must modify the role settings for Global Administrator to require approval, set maximum activation duration to 4 hours, require justification, and select GA-Approvers as the approvers. All of these settings are configured in the role settings page. Eligible assignments only define who is eligible to activate the role; they do not specify approvers. Therefore, Option A (which includes the required settings) is correct, and Option C is incorrect.
Variation 4. A company uses Azure AD Privileged Identity Management (PIM) for role activation. They want to require that any activation of the Security Administrator role be approved by a designated group of approvers called 'Security Approvers'. Activations must include a ticket number and expire after 8 hours. Which PIM configuration should the administrator modify?
medium- ✓ A.Role settings for Security Administrator
- B.Role assignments for Security Administrator
- C.Access reviews for Security Administrator
- D.Alerts for Security Administrator
Why A: Azure AD PIM role settings for a specific role, such as Security Administrator, control activation requirements including approval workflow, justification (ticket number), and maximum activation duration. By modifying the role settings, the administrator can require approval from the 'Security Approvers' group, mandate a ticket number, and set an 8-hour expiration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.