SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company wants to implement just-in-time (JIT) privileged access management for their Global Administrators in Microsoft Entra ID. They require that a user must request activation of the Global Administrator role, the request must be approved by a separate administrator, and the role will automatically expire after 4 hours. Additionally, they need an audit trail of all activations. Which Microsoft Entra feature should they use?
⚠ Common exam trap
Many candidates confuse Azure RBAC (which manages Azure resource permissions) with PIM (which manages Microsoft Entra ID directory roles and JIT activation), leading them to select option D despite Azure RBAC lacking approval workflows and automatic expiry for directory roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate roles like Global Administrator on-demand, requiring approval from designated approvers, setting a maximum activation duration (e.g., 4 hours), and automatically deactivating the role upon expiry. It also maintains a full audit trail of all activations, approvals, and role assignments via the PIM audit history and Azure AD audit logs, meeting all the stated requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies evaluate specific conditions, such as user location, device compliance, or sign-in risk, at the point of authentication to enforce access controls like multi-factor authentication or blocking access. While crucial for securing access to applications and resources, Conditional Access does not provide mechanisms for just-in-time role activation, time-bound assignments, or approval workflows for elevating privileged roles within Microsoft Entra ID.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is designed to detect and remediate identity-based risks, such as leaked credentials, impossible travel, or unfamiliar sign-in properties, by applying automated policies like requiring password resets or blocking sign-ins. Its primary function is risk detection and response for user identities and their sign-in behavior, not the management of temporary, time-bound access to administrative roles or the implementation of approval processes for privileged role activation.
- ✓
Microsoft Entra Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables Just-In-Time (JIT) access by allowing users to activate privileged roles only when needed, for a limited duration, and often requiring multi-factor authentication or an approval workflow. PIM also enforces time-bound assignments and provides comprehensive auditing and review capabilities for all privileged role activations, directly addressing the requirement for JIT privileged access management.
- ✗
Azure Role-Based Access Control (RBAC)
Why it's wrong here
Azure Role-Based Access Control (RBAC) is a granular authorization system used to manage access to Azure resources, such as virtual machines, storage accounts, and databases, within an Azure subscription. It defines who (identity) has what (role definition) access to where (scope) within the Azure resource plane. While fundamental for securing Azure infrastructure, Azure RBAC itself does not inherently provide Just-In-Time (JIT) activation for Microsoft Entra ID administrative roles or incorporate approval workflows for these directory-level roles.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.