SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team needs to grant temporary elevated access to the Global Administrator role for a specific task, such as configuring a new security policy. They want the user to request activation, which is then approved by a manager, and the privileges automatically expire after 4 hours. Which Microsoft Entra feature should they use?
⚠ Common exam trap
It's easy for candidates to confuse Privileged Identity Management (PIM) with Conditional Access, because both involve policies and access control, but PIM specifically handles just-in-time privileged role activation with approval and expiration, while Conditional Access focuses on access conditions for all users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing users to request activation of roles like Global Administrator. The activation can require approval from a manager and is automatically deactivated after a configurable maximum duration (e.g., 4 hours), directly meeting the security team's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies evaluate various signals, such as user identity, device state, location, and application, to enforce access controls at the time of a sign-in attempt. While it can block access or require multi-factor authentication based on these conditions, it does not provide mechanisms for just-in-time (JIT) activation of privileged roles or time-bound role assignments, which is distinct from managing temporary elevated permissions.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection focuses on detecting and remediating identity-based risks, such as leaked credentials, impossible travel, or atypical sign-in locations, using machine learning to identify suspicious activities. It can trigger automated responses like blocking sign-ins or forcing password changes. However, Identity Protection does not offer functionality for managing the lifecycle of privileged roles, including just-in-time activation or time-bound assignments, as its primary purpose is risk detection and remediation.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed and for a limited, predefined duration, often requiring an approval workflow. PIM also provides automatic expiration of assignments and comprehensive auditing, significantly reducing the attack surface associated with standing privileged access.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
Self-Service Password Reset (SSPR) allows users to securely reset their forgotten or locked passwords without requiring administrator intervention, thereby enhancing user productivity and reducing help desk calls. This feature empowers users to manage their own credentials through verified methods. However, SSPR is exclusively focused on password management and has no capabilities related to the activation, assignment, or management of privileged administrative roles within Microsoft Entra ID.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.