SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?
⚠ Common exam trap
Watch out — candidates often confuse Privileged Identity Management (PIM) with Conditional Access, thinking that Conditional Access can enforce time-limited access, but Conditional Access only controls sign-in conditions, not the duration of privileged role assignments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Entra Verified ID
Why it's wrong here
Microsoft Entra Verified ID enables organizations to issue and verify decentralized digital identities and verifiable credentials. While it allows users to prove attributes about themselves (e.g., employment status, education), it does not directly facilitate the granting of temporary, time-limited access to specific resources within an Azure environment. Its primary function is credential verification, not just-in-time access management.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources by providing just-in-time (JIT) and just-enough-access (JEA) capabilities. It allows administrators to grant temporary, time-limited access to privileged roles, which can be activated on demand for a specified duration. This ensures that users only have elevated permissions when absolutely necessary, significantly reducing the attack surface.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a security module focused on detecting and remediating identity-based risks, such as compromised credentials or suspicious sign-in behaviors. It analyzes sign-in data and user behavior to identify potential threats and can trigger automated responses like multi-factor authentication prompts or password resets. However, it does not provide functionality for granting temporary, time-limited access to resources; its role is purely risk detection and response.
- ✗
Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access is a policy engine that evaluates specific conditions (e.g., user location, device compliance, application being accessed) to determine whether to grant, block, or require additional authentication for resource access. While it can enforce time-based restrictions on session lifetimes, it does not inherently grant temporary, time-limited access to roles or resources. Instead, it acts as an enforcement layer for existing access permissions, ensuring they are used securely.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.