SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time access to Azure AD roles and Azure resources. Configure approval workflows for high-privilege roles. Set maximum activation durations. For non-Azure resources, use Privileged Access Groups (PAG) to manage access. Enable audit logging to a Log Analytics workspace for monitoring.

  Why this is correct

  This is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) administrative access, meaning users get the rights only when needed and for a limited, configurable duration. For high-privilege roles, you can require approval workflows so that activations are explicitly authorized, and setting maximum activation durations enforces a time-bound window that minimizes standing privilege. For non-Azure resources such as on-premises apps or Azure AD-joined groups, Privileged Access Groups (PAG) extend PIM's JIT and approval controls to group membership. Additionally, routing audit logs to a Log Analytics workspace centralizes monitoring and enables alerting on suspicious activations, which satisfies both security and compliance requirements.

• ✗

  Create a custom role in Azure AD with limited permissions. Assign the role to a security group. Have users request access via a manual email process. The IT team approves and assigns the group membership temporarily.

  Why it's wrong here

  This option is incorrect because it relies on a manual email process, which is error-prone, unscaleable, and lacks the automated just-in-time activation logic that PIM provides. Manually assigning group membership temporarily creates a window of standing access because there is no enforced expiration or approval workflow; IT must remember to revoke access, which often leads to overprivileged accounts. It also fails to produce reliable audit trails—email threads are not immutable access logs, and there is no built-in monitoring to Log Analytics for centralized detection of misuse. The time-consuming process introduces human error and does not meet least privilege or compliance requirements for a large retail enterprise.

• ✗

  Assign permanent roles to seasonal workers for the duration of their contract. Use Azure AD access reviews to periodically confirm access. Enable Azure AD audit logs. Use Conditional Access to require MFA for privileged roles.

  Why it's wrong here

  This option is incorrect because assigning permanent roles to seasonal workers for the length of their contract creates standing privileged access, which violates the principle of least privilege. Azure AD access reviews are periodic (often quarterly or monthly) and do not provide real-time JIT revocation; between reviews, users retain permissions that may no longer be needed for their current tasks. While enabling audit logs and requiring MFA via Conditional Access are good hygiene, they are compensating controls and do not eliminate the risk of a compromised account with persistent high privilege. The correct approach is to use PIM with time-bound activations and approvals to ensure that even seasonal workers get access only when they need it and for the shortest possible duration.

• ✗

  Create separate Azure AD roles for each seasonal worker with granular permissions. Use Azure AD Identity Governance to automate access requests. Do not enable PIM to reduce complexity.

  Why it's wrong here

  This option is incorrect because creating a separate Azure AD role for each seasonal worker leads to role sprawl: it increases administrative overhead, complicates access reviews, and makes it difficult to manage permissions consistently at scale, especially for a global retail company. Azure AD Identity Governance can automate access request workflows, but without PIM, role assignments remain static (permanent) and users are not prompted for just-in-time activation, so they are still standing assignments. Deliberately omitting PIM to reduce complexity undermines the core JIT, approval, and time-bound capabilities that are essential for managing high-privilege access. Instead, use a small number of well-scoped roles or Privileged Access Groups under PIM governance to achieve both granularity and control without excessive management burden.

Go deeper

Related to this question