SC-900 Describe the capabilities of Microsoft Entra Practice Question
An organization needs to grant its IT administrators temporary access to the Global Administrator role. The access should require a separate approval from a designated manager before activation, and the permissions should automatically expire after 4 hours. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Many exam-takers confuse Privileged Identity Management (PIM) with Conditional Access, mistakenly thinking that Conditional Access can enforce time-limited role activation, when in fact PIM is the only feature that provides just-in-time privileged access with approval and automatic expiration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing IT administrators to activate the Global Administrator role for a limited time (e.g., 4 hours) only after receiving approval from a designated manager. This directly meets the requirement for temporary, approval-based, and auto-expiring permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Azure AD Conditional Access policies enforce specific controls based on various conditions, such as user location, device compliance, or application being accessed, at the time of sign-in. While it can require MFA or block access, it primarily acts as a gatekeeper for *existing* access rights. Conditional Access does not facilitate the *request and approval* of temporary elevated privileges for administrative roles; it only governs how existing access is utilized.
When this WOULD be correct
An organization needs to require multi-factor authentication for all users accessing a sensitive application from outside the corporate network. Conditional Access would be the correct feature to configure such a policy.
- ✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection primarily focuses on detecting identity-based risks, such as compromised credentials, anomalous sign-in locations, or infected devices. It then enforces automated remediation policies like requiring multi-factor authentication or password resets. While crucial for security, it does not provide a mechanism for requesting, approving, or time-limiting administrative role assignments, which is the core need described.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed and for a limited duration. This process often includes an approval workflow, multi-factor authentication, and automatic deactivation of the role after the specified time, directly addressing the requirement for temporary, controlled access.
- ✗
Access Reviews
Why it's wrong here
Azure AD Access Reviews are used to ensure that users still have appropriate access rights by periodically reviewing group memberships or application assignments. They facilitate re-certification by designated reviewers, who can approve or deny continued access. However, Access Reviews are a governance tool for auditing existing access, not for granting temporary, on-demand privileged access with an approval workflow and automatic expiration, which is the specific need.
When this WOULD be correct
An organization needs to periodically verify that all users with Global Administrator access still require that role, and remove those who no longer need it. Access Reviews would be the correct feature to configure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Privileged Identity Management (PIM)Correct answer▾
Why this is correct
Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization. It enables just-in-time (JIT) access, allowing administrators to activate privileged roles only when needed and for a limited duration. This process often includes an approval workflow, multi-factor authentication, and automatic deactivation of the role after the specified time, directly addressing the requirement for temporary, controlled access.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access enforces access policies based on signals like user location or device state, but it does not provide just-in-time role activation with approval and automatic expiry.
★ When this WOULD be the correct answer
An organization needs to require multi-factor authentication for all users accessing a sensitive application from outside the corporate network. Conditional Access would be the correct feature to configure such a policy.
Why candidates choose this
Candidates may confuse Conditional Access with access control for privileged roles, not realizing it governs user access to resources rather than role activation workflows.
✗Access ReviewsWrong answer — click to see why▾
Why this is wrong here
Access Reviews are used to audit and confirm the ongoing need for group memberships or role assignments, not to grant temporary, approval-based activation of privileged roles with automatic expiration.
★ When this WOULD be the correct answer
An organization needs to periodically verify that all users with Global Administrator access still require that role, and remove those who no longer need it. Access Reviews would be the correct feature to configure.
Why candidates choose this
Candidates may confuse Access Reviews with PIM because both involve privileged roles and oversight, but Access Reviews focus on periodic attestation rather than just-in-time activation with approval.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.