SC-100 Design security solutions for infrastructure Practice Question
Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged role activation, time-bound assignments, and approval workflows for Azure resources and Entra ID roles, which directly matches the requirement. PIM also supports access reviews, MFA enforcement on activation, and audit trails for privileged access. Microsoft Defender for Identity is a threat detection service for identity-based attacks, not a JIT access or approval mechanism. Microsoft Entra ID administrative units are used to scope administrative permissions to subsets of users or groups, not to provide just-in-time activation or approvals. Microsoft Entra Conditional Access enforces access policies based on conditions such as user, device, and location, but it does not provide JIT role activation or approval workflows.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Microsoft Defender for Identity is a security monitoring tool focused on detecting attacks on on-premises Active Directory, such as lateral movement, kernel exploits, and suspicious Kerberos delegation. It leverages behavioral analytics to identify compromised identities, but it does not manage or control the activation of privileged roles. Thus, it cannot provide just-in-time access with approvals; it only alerts on malicious activity after the fact.
- ✗
Microsoft Entra ID administrative units
Why it's wrong here
Microsoft Entra ID administrative units are used to scope administrative permissions to a specific subset of users, groups, or devices, such as limiting a Helpdesk Admin to only manage users in the Sales department. While they help with delegation and creating boundaries, they do not support just-in-time activation or approval-based workflows. A role assignment scoped by an administrative unit is always static until changed, lacking the temporary elevation capability that PIM provides.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is an identity-driven access control engine that evaluates signals such as user location, device compliance, and sign-in risk to decide whether to grant access to applications. It enforces policies like requiring MFA or blocking access, but it does not provide a mechanism for time-limited role activation or approval-based privilege elevation. Those capabilities are the domain of Privileged Identity Management, making this choice incorrect for just-in-time role activation.
- ✓
Microsoft Entra Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the correct service for just-in-time privileged access. PIM allows an admin to configure roles so that users become eligible, and then activate the role for a specified time window, optionally requiring multi-approval. It also provides auditing, alerts, and access reviews to govern privilege use, directly addressing the need for approval workflows and time-bound activation.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.