SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse Conditional Access policies (which control sign-in conditions) with PIM (which controls role activation and approval workflows), leading candidates to select MFA enforcement instead of the JIT and review capabilities unique to PIM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the dedicated service for managing, controlling, and monitoring access to important resources. It enables just-in-time (JIT) access, meaning users are assigned privileged roles only when needed and for a limited duration. Requiring approval for role activation ensures an additional layer of control, while access reviews provide periodic verification that users still require their assigned privileges, enforcing the principle of least privilege.
- ✗
Configure Conditional Access policies to require MFA for privileged roles.
Why it's wrong here
Configuring Conditional Access policies to require multi-factor authentication (MFA) for privileged roles enhances security by ensuring only verified identities can access these roles. However, Conditional Access grants standing access once the policy conditions are met; it does not provide just-in-time (JIT) activation. This means users would continuously hold the privileged role, rather than elevating their privileges only for specific administrative tasks, which is a key requirement for robust privileged access management.
- ✗
Use Microsoft Entra Entitlement Management to create access packages for roles.
Why it's wrong here
Microsoft Entra Entitlement Management is designed to manage access to resources through access packages, which can bundle group memberships, applications, and SharePoint sites. While it can streamline the request and approval process for access to these packages, it is not primarily intended for the just-in-time (JIT) activation of administrative roles within Microsoft Entra ID. It lacks the specific capabilities of PIM for time-bound role assignments and granular activation workflows for privileged roles.
- ✗
Create an Identity Protection risk policy to block risky sign-ins for privileged users.
Why it's wrong here
Microsoft Entra Identity Protection focuses on detecting and remediating identity-based risks, such as anomalous sign-ins or compromised credentials, by enforcing actions like blocking access or requiring MFA. While crucial for preventing unauthorized access to privileged accounts, it operates at the sign-in risk level. It does not provide the mechanism for just-in-time (JIT) activation of privileged roles or managing the temporary elevation of privileges for legitimate administrative tasks, which is a distinct security control.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
PIM
Privileged Identity Management, a Microsoft Azure Active Directory tool that manages, monitors, and controls access to privileged roles on a just-in-time basis.
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.