Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Defender for Identity or Microsoft Sentinel as the primary alerting tool for Entra ID role assignments, but PIM is the native, purpose-built service for this specific identity governance task.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID Privileged Identity Management (PIM)
Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it provides built-in alerting capabilities specifically for privileged role assignments in Microsoft Entra ID. PIM can generate alerts when a user is assigned a privileged role, such as Global Administrator, without requiring additional configuration or external data sources. This aligns directly with the requirement to receive alerts for privileged role assignments within the identity platform.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra ID Privileged Identity Management (PIM)
Why this is correct
PIM is the native Microsoft Entra ID identity governance engine that delivers built-in, out-of-the-box alerting for privileged role assignments and activations. It monitors for suspicious activities such as permanent privileged assignments, off-hours role activation, or activation attempts that bypass just-in-time access policies, and can trigger email notifications or integrate with SIEM tools. These alerts are natively scoped to Entra ID roles, requiring no additional log ingestion or custom rule authoring, making it the correct choice for this requirement.
- ✗
Microsoft Defender for Identity
Why it's wrong here
Defender for Identity is an on-premises Active Directory (AD) security tool that analyzes agent-observed domain controller traffic to detect attacker techniques like Pass-the-Hash, Kerberos attacks, and reconnaissance. While it can provide identity-related alerts for hybrid environments, its native scope is on-premises AD domain traffic, not cloud-based Entra ID role assignments or PIM activations. To generate alerts on Entra ID privileged actions, it would require external log forwarding and custom detection logic, so it is not the direct, built-in alerting mechanism the scenario needs.
- ✗
Microsoft Sentinel
Why it's wrong here
Sentinel is a cloud-native SIEM that can indeed alert on Entra ID activity, but it requires a multi-step setup: enabling diagnostic settings in Entra ID to stream auditSignIn and DirectoryLogs to a Log Analytics workspace, then writing and tuning KQL analytics rules, and then creating automation for incident response. This is an indirect and operationally heavy path compared to PIM's native alerting, and it introduces ingestion costs and latency. Because Sentinel has no built-in rules that specifically map to PIM's privileged role alert scenarios, it would be overengineering this straightforward need for alerts on privileged role assignments.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Defender for Cloud Apps is a Microsoft CASB primarily designed to discover shadow IT, control sanctioned SaaS app usage, and protect users’ sessions through conditional access app control. It focuses on securing third-party cloud applications (like Salesforce, Dropbox, or Box) via app connectors and anomaly detection policies, rather than governing role assignments inside Microsoft Entra ID itself. While it might ingest some Entra ID sign-in logs for a broader view, it lacks native, purpose-built alerts for PIM privileged role activations or permanent assignments, so it is not the appropriate tool for this specific alerting requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.