SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?
⚠ Common exam trap
It's easy for candidates to confuse PIM with Conditional Access, thinking that Conditional Access can enforce time-limited access via session controls, but Conditional Access cannot grant or revoke Azure RBAC role assignments or require an approval workflow for role activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure AD and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies enforce access decisions at the time of sign-in based on various conditions such as user, group, location, device state, or sign-in risk. While it can require multi-factor authentication or block access, it does not provide a mechanism for just-in-time, time-bound elevation of administrative roles with integrated approval workflows. Its primary function is to control how and under what conditions a user accesses a resource, not to temporarily grant elevated permissions.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks by identifying compromised credentials, suspicious sign-ins, and risky users. It focuses on applying policies like requiring password changes, blocking access, or enforcing multi-factor authentication in response to detected threats. However, it does not offer features for managing the lifecycle of privileged roles, such as enabling just-in-time activation or implementing approval workflows for temporary elevated access.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the dedicated solution for managing, controlling, and monitoring access to critical resources across Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate eligible administrative roles for a limited, time-bound period. PIM also supports multi-stage approval workflows for role activation, ensuring that elevated privileges are granted only when necessary and with proper authorization, directly addressing the requirement for time-bound, approved elevation.
- ✗
Entra ID Governance
Why it's wrong here
Microsoft Entra ID Governance focuses on ensuring that the right people have the right access to the right resources at the right time, primarily through features like access reviews, entitlement management, and lifecycle workflows. While it manages the broader access lifecycle and can review existing permissions, it does not natively provide the just-in-time, time-bound role activation with integrated approval workflows that PIM offers for elevating administrative privileges. Its role is more about comprehensive access management and auditing rather than temporary privilege elevation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.