Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A financial institution requires strict control over administrative roles in Microsoft Entra ID. They want to ensure that users are granted elevated privileges only when absolutely necessary and for a limited time, with an audit trail of all activations. Which Microsoft Entra capability supports this 'just-in-time' and 'just-enough-access' principle for privileged roles?
- AMicrosoft Entra Identity Protection
- BMicrosoft Entra Privileged Identity Management (PIM)
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Access Reviews
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) is designed to manage, control, and monitor access to important resources by providing just-in-time and just-enough access, along with reporting and auditing capabilities for privileged roles.
Why the other options are wrong
- A. Identity Protection detects risks, not manages privileged role assignments.
- C. Conditional Access applies policies based on conditions, but doesn't manage time-bound privileged role activation.
- D. Access Reviews periodically confirm existing access, not manage temporary elevation of privilege.
Microsoft Entra Privileged Identity Management (PIM)
A service that enables you to manage, control, and monitor access to important resources in your organization.
- Provides just-in-time (JIT) access for privileged roles.
- Enforces approval workflows for role activation.
- Offers audit logs for all privilege escalations.
Memory trick: PIM is the 'king' of 'just-in-time' access for your VIPs.