SC-900 Describe the capabilities of Microsoft Entra Practice Question
Your organization uses Microsoft Entra ID with P2 licenses. You need to review and approve role activations for the Global Administrator role on a weekly basis. Which feature should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) allows you to manage, control, and monitor access to important resources in your organization, including the ability to review and approve role activations for privileged roles like Global Administrator. Option A is wrong because Identity Protection is for detecting risks and vulnerabilities. Option B is wrong because Conditional Access controls access based on conditions, not role activation approval. Option D is wrong because Access Reviews are for reviewing and recertifying access assignments, but not specifically for approving activations in real-time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is designed to detect and remediate identity-based risks, such as compromised credentials, anomalous sign-ins, and vulnerable users. While crucial for security, it focuses on real-time risk detection and automated response to protect identities from compromise by blocking or challenging risky sign-ins. It does not provide the mechanism for requesting, approving, and temporarily activating administrative roles on a just-in-time basis.
- ✗
Microsoft Entra Conditional Access
Why it's wrong here
Microsoft Entra Conditional Access policies enforce specific controls based on various conditions like user, location, device, or application, determining if and how a user can access a resource. While it can require multi-factor authentication or compliant devices for access, it does not provide a mechanism for requesting and approving temporary, time-bound elevation of administrative roles. Its purpose is policy enforcement for existing access, not privilege management for temporary role activation.
- ✓
Microsoft Entra Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the correct solution for managing, controlling, and monitoring access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate privileged roles for a limited, predefined time, significantly reducing the exposure window of high-privilege accounts. PIM also integrates approval workflows, multi-factor authentication requirements for activation, and comprehensive audit trails, ensuring that elevated permissions are granted only when necessary and are fully accountable.
- ✗
Microsoft Entra Access Reviews
Why it's wrong here
Microsoft Entra Access Reviews are primarily used to periodically review existing access assignments to ensure that users still require the access they have been granted. This process helps maintain the principle of least privilege by identifying and removing stale or unnecessary permissions from standing assignments. However, Access Reviews do not facilitate the temporary activation of privileged roles or manage just-in-time access requests; their focus is on the ongoing validation of static, permanent access, not dynamic privilege elevation.
Go deeper
Related to this question
Learn chapter
Identity Concepts
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Identity protection
Identity protection is the set of policies, technologies, and practices used to secure digital identities and prevent unauthorized access to systems and data.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.