Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: PIM provides just-in-time (JIT) privileged access.
A tenant administrator is advising a department that wants to grant temporary, approved privileged administrator access. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Watch out — candidates often confuse PIM with other Microsoft 365 tools that have 'management' or 'planning' in their names, but only PIM provides the specific privileged access governance required for temporary administrator roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged access, allowing the tenant administrator to grant temporary, approved administrator roles with time-bound activation and approval workflows. PIM is part of Microsoft Entra ID Governance and directly addresses the requirement for temporary privileged access with oversight.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management (PIM) provides time-bound, just-in-time activation of built-in roles in Microsoft Entra ID, such as Global Administrator or Privileged Role Administrator. By making a user eligible for a role, the tenant can require on-demand activation with optional approval, justification, and multi-factor authentication. This eliminates permanent standing privileged access and creates detailed audit records for every activation, directly supporting the department's need for controlled, temporary elevation of administrator rights.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is an online survey and quiz building tool used to collect user responses through web, mobile, or embeddable URLs. It stores results in Excel and integrates with Microsoft 365 Groups, but it has no mechanism to manage directory role assignments or enforce time-bound privileged access. Because the requirement is about securing elevated roles rather than gathering data, Forms lacks any control over who can activate administrator permissions or how long those permissions remain valid.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is a video hosting and streaming platform designed to store, share, and playback recorded and live content inside Microsoft 365. While Stream supports sharing permissions and viewer access controls, those are content-level restrictions and do not bind to Microsoft Entra ID roles or privilege activation workflows. Therefore Stream cannot provide just-in-time elevation of administrative rights, approval-based role activation, or the auditing of privileged actions required in this scenario.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a team task management tool that organizes work into plans, buckets, and cards with assigned due dates and checklists. Its collaboration model only controls who can view or edit a specific plan, not who can hold or activate administrator-level roles in the tenant. Because Planner has no native integration with Microsoft Entra ID role eligibility or time-bound activation, it cannot meet a security requirement involving privileged identity management and compliance auditing.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.