SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A financial institution wants to apply the principle of least privilege to its Microsoft Entra ID environment. The IT team needs to ensure that administrators only have the permissions necessary to perform their job functions and that these permissions are activated only when needed. Which feature should they implement?
⚠ Common exam trap
The trap here is selecting Conditional Access because it is commonly used for access control, but it does not provide just-in-time privileged role activation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) is designed to implement least privilege by providing just-in-time privileged access, approval workflows, and time-bound role activations. Conditional Access, ID Protection, and Access Reviews address other aspects of identity security but do not offer the same just-in-time privileged access management capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Entra Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) enables just-in-time role activation, ensuring that administrators only have privileged access when needed. It enforces least privilege by requiring approval, multi-factor authentication, and justification for role activation. PIM also provides auditing and alerts for privileged actions, helping the organization maintain tight control over administrative access and reduce the attack surface.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Conditional Access policies evaluate signals like user, device, and location to make access decisions, but they do not manage privileged role assignments or provide just-in-time activation. While Conditional Access can enforce multi-factor authentication for administrators, it does not control the duration or activation of privileged roles. It is a policy engine for access control, not a privileged identity management solution.
- ✗
Microsoft Entra Access Reviews
Why it's wrong here
Access reviews are used to periodically review and attest to users' access rights, ensuring they are appropriate. While they help maintain least privilege by removing unnecessary access, they do not provide just-in-time activation of privileged roles. Access reviews are a governance feature, not a mechanism for on-demand privilege elevation with approval workflows and time-bound activation.
- ✗
Microsoft Entra ID Protection
Why it's wrong here
Microsoft Entra ID Protection detects and remediates identity-based risks, such as leaked credentials or risky sign-ins. It does not manage privileged roles or enforce least privilege through just-in-time activation. While it can alert on risky administrator behavior, it does not provide the mechanism to activate roles only when needed or require approval for role assignment.
Go deeper
Related to this question
Learn chapter
Entra Internet Access and Private Access
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.