SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company needs to grant IT administrators temporary and time-limited access to privileged roles in Microsoft Entra ID (Azure AD). The access must require approval from a manager and be automatically revoked after the task is completed. Which Microsoft Entra ID feature should be used?
⚠ Common exam trap
Watch out — candidates often confuse Entitlement Management (which manages access packages for non-privileged resources) with PIM (which specifically handles time-limited privileged role activation with approval), leading candidates to choose D because they see 'approval' and 'temporary access' without recognizing the privileged role context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing administrators to activate eligible role assignments for a limited duration. It supports approval workflows (e.g., manager approval) and automatically deactivates the role when the activation time expires or the task is completed, meeting the requirement for temporary, time-limited, approved, and auto-revoked access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies evaluate specific conditions, such as user location, device compliance, or sign-in risk, to determine if access to an application or service should be granted, blocked, or require additional authentication. While it can enforce strong authentication or device compliance *during* an access attempt, it does not provide the mechanism to activate a privileged role for a temporary period or manage its lifecycle, which is the core requirement of the question.
When this WOULD be correct
A company needs to require multi-factor authentication or block access from untrusted locations when administrators sign in to the Azure portal. Conditional Access would be the correct feature to enforce such policies.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection focuses on detecting and remediating identity-based risks, such as leaked credentials, impossible travel, or anomalous sign-in activities. It uses machine learning to identify suspicious behaviors and can automate responses like blocking sign-ins or forcing password resets. However, Identity Protection's purpose is risk detection and mitigation for user identities, not the management or temporary activation of administrative roles for just-in-time access.
When this WOULD be correct
A company wants to automatically detect and block sign-ins from anonymous IP addresses or enforce multi-factor authentication based on risk level. Which Microsoft Entra ID feature should be used?
- ✓
Privileged Identity Management (PIM)
Why this is correct
Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources in Azure AD, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed, for a specific, time-limited duration. This includes features like multi-factor authentication (MFA) enforcement during activation, approval workflows, and comprehensive audit logs, directly fulfilling the requirement for temporary and time-limited administrative access.
- ✗
Entitlement Management
Why it's wrong here
Azure AD Entitlement Management allows organizations to manage identity and access lifecycle at scale by creating access packages that bundle resources like applications, SharePoint sites, and groups. It supports self-service requests and approval workflows for users to gain access to these packages. While it manages access and includes time-limited assignments, its primary function is for broader resource access provisioning for internal and external users, not for the just-in-time, temporary elevation of *privileged Azure AD administrative roles*.
When this WOULD be correct
A company needs to allow employees to request access to a set of applications and groups for a specific project, with approval from their manager and automatic expiration after 30 days. Entitlement Management would be the correct feature to create access packages for this scenario.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Privileged Identity Management (PIM)Correct answer▾
Why this is correct
Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources in Azure AD, Azure, and other Microsoft services. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed, for a specific, time-limited duration. This includes features like multi-factor authentication (MFA) enforcement during activation, approval workflows, and comprehensive audit logs, directly fulfilling the requirement for temporary and time-limited administrative access.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access enforces access policies based on signals like user location or device state, but it does not provide time-limited, approval-based activation of privileged roles or automatic revocation.
★ When this WOULD be the correct answer
A company needs to require multi-factor authentication or block access from untrusted locations when administrators sign in to the Azure portal. Conditional Access would be the correct feature to enforce such policies.
Why candidates choose this
Candidates may confuse Conditional Access with access control for privileged roles, not realizing it governs sign-in conditions rather than role activation and approval workflows.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage time-limited privileged role assignments with approval workflows.
★ When this WOULD be the correct answer
A company wants to automatically detect and block sign-ins from anonymous IP addresses or enforce multi-factor authentication based on risk level. Which Microsoft Entra ID feature should be used?
Why candidates choose this
Candidates may confuse Identity Protection with Privileged Identity Management because both involve security and identity, but Identity Protection focuses on risk detection rather than role activation and approval workflows.
✗Entitlement ManagementWrong answer — click to see why▾
Why this is wrong here
Entitlement Management manages access packages and resource access requests, but it does not provide time-limited, automatically revoked privileged role assignments with manager approval; PIM handles just-in-time privileged role activation.
★ When this WOULD be the correct answer
A company needs to allow employees to request access to a set of applications and groups for a specific project, with approval from their manager and automatic expiration after 30 days. Entitlement Management would be the correct feature to create access packages for this scenario.
Why candidates choose this
Candidates may confuse Entitlement Management's approval and expiration features with PIM's privileged role activation, not realizing that Entitlement Management is for general resource access, not privileged role management.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.