SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to provide just-in-time (JIT) administrative access to Azure resources. They require that administrators must request approval before gaining elevated privileges, and that the elevated access automatically expires after the task is completed. Which Microsoft Entra capability should they use?
⚠ Common exam trap
Candidates often confuse Conditional Access (which controls access to apps and resources) with PIM (which controls time-bound elevation of roles), because both involve 'access' and 'conditions,' but only PIM provides JIT activation with approval and automatic expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. PIM allows administrators to request elevation for a specific role, which must be approved by designated approvers, and the elevated access automatically expires after the configured duration (e.g., 1–8 hours). This directly meets the security team's requirements for approval-based, time-limited administrative access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access evaluates signals and enforces grant or session controls at authentication, but it does not issue eligible role assignments or approval workflows. Privileged Identity Management is required here, as it delivers just-in-time activation with approver sign-off and automatic expiry of elevated privileges.
- ✗
Identity Protection
Why it's wrong here
Identity Protection detects and scores risky users and sign-ins, feeding Conditional Access policies; it cannot broker approval-gated role activation. Privileged Identity Management is the correct capability, since it provides eligible assignments, approver workflows and time-bound activation that expires automatically.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Privileged Identity Management delivers just-in-time role activation with approval workflows and time-bound assignments that expire automatically. This satisfies both constraints: administrators must request approval before elevation, and the elevated access is removed once the task completes, rather than persisting as standing privilege.
- ✗
Self-Service Password Reset (SSPR)
Why it's wrong here
SSPR lets users reset their own passwords; it grants no privileged role activation, approval workflow or time-bound expiry. It is tempting because it reduces helpdesk load for credential recovery, and would be correct if the requirement were self-service password resets rather than just-in-time elevation via Privileged Identity Management.
Go deeper
Related to this question
Learn chapter
Azure Policy and Initiatives
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.