Describe the capabilities of Microsoft Entra →easyMultiple ChoiceObjective-mapped

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Refer to the exhibit. The exhibit shows a Microsoft Entra ID audit log entry:

```json
{
  "activityDisplayName": "Add member to role",
  "activityDateTime": "2025-12-01T09:00:00Z",
  "targetResources": [{
    "id": "abc",
    "displayName": "Global Administrator",
    "modifiedProperties": [{
      "displayName": "Role.DisplayName",
      "newValue": "\"Global Administrator\""
    }]
  }]
}
```

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

⚠ Common exam trap

Test-takers frequently confuse Conditional Access (which controls access to resources) with Privileged Identity Management (which controls elevation to administrative roles), leading them to select Conditional Access when the question explicitly asks for just-in-time role access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Privileged Identity Management

Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Privileged Identity Management
Why this is correct
Privileged Identity Management (PIM) is the dedicated Azure AD service designed to manage, control, and monitor access to important resources. It enables just-in-time (JIT) access, allowing users to activate privileged roles like Global Administrator only when needed and for a limited duration. This significantly reduces the attack surface by eliminating standing administrative access and provides robust auditing capabilities for all role activations.
✗
Conditional Access
Why it's wrong here
Conditional Access policies enforce specific conditions at the time of user sign-in to determine whether access to applications or resources should be granted, blocked, or require additional authentication. While crucial for securing access, it operates on the principle of evaluating user and device context *before* accessing a resource, rather than managing the activation or deactivation of administrative roles themselves for just-in-time elevation.
✗
Self-Service Password Reset
Why it's wrong here
Self-Service Password Reset (SSPR) is an Azure AD feature that empowers users to reset their own forgotten passwords or unlock their accounts without requiring IT help desk intervention. Its primary function is to enhance user productivity and reduce support costs related to password management. SSPR has no functionality related to the assignment, activation, or time-bound management of administrative roles within Azure AD.
✗
Identity Protection
Why it's wrong here
Azure AD Identity Protection is a security tool focused on detecting and remediating identity-based risks, such as compromised credentials, anomalous sign-in behaviors, or risky user activities. It identifies vulnerabilities and can automate responses like requiring multi-factor authentication or blocking access based on risk levels. However, Identity Protection does not provide mechanisms for granting, activating, or managing privileged administrative roles on a just-in-time basis.

Go deeper

SC-900 Describe the capabilities of Microsoft Entra Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question