SC-900 Describe the capabilities of Microsoft Entra Practice Question
An administrator needs to grant a vendor temporary access to an Azure subscription for exactly 48 hours. After that time, access must be automatically revoked. Which Microsoft Entra feature should be used?
⚠ Common exam trap
Many exam-takers confuse PIM's just-in-time access with External Identities (B2B), assuming that inviting a guest user inherently includes time limits, but B2B invitations do not automatically expire unless combined with other features like access reviews or PIM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management
Microsoft Entra Privileged Identity Management (PIM) allows administrators to configure just-in-time (JIT) access with time-bound activation and automatic expiration. By setting a maximum activation duration of 48 hours for a role assignment, PIM ensures the vendor's access is automatically revoked after that period without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra External Identities
Why it's wrong here
While Microsoft Entra External Identities allows inviting vendors as guest users and managing their identity lifecycle within your tenant, it does not inherently provide mechanisms for time-bound role assignments or automatic expiration of access to specific resources. Its primary function is identity federation and guest user management, not just-in-time or time-limited access control for roles, making it unsuitable for automatically expiring temporary access.
- ✓
Microsoft Entra Privileged Identity Management
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the correct solution because it enables just-in-time (JIT) and time-bound access to resources and roles. Administrators can assign a vendor a specific role for a predefined duration, and PIM will automatically revoke that access once the assignment period expires. This ensures temporary access is granted only when needed and automatically removed, aligning perfectly with the requirement for automatic expiration.
- ✗
Microsoft Entra access reviews
Why it's wrong here
Microsoft Entra access reviews are designed to periodically evaluate and recertify existing access assignments, ensuring that users still require the permissions they have. While they can identify stale access, access reviews do not automatically expire or revoke access based on a predefined temporary duration. They rely on manual or automated approval/denial decisions during the review cycle, rather than proactive, time-bound access revocation.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies enforce specific conditions for accessing resources, such as requiring multi-factor authentication, compliant devices, or access from trusted locations. These policies determine *how* a user can access a resource, not *for how long* they have access or whether their role assignment automatically expires. Conditional Access does not manage the lifecycle or duration of role assignments themselves, making it unsuitable for automatically expiring temporary access.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.