Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the capabilities of Microsoft EntraMedium
A security auditor observes that several users have been assigned highly privileged roles in Microsoft Entra ID, such as Global Administrator, on a permanent basis. The auditor recommends implementing a solution that provides just-in-time and just-enough access for these roles. Which Microsoft Entra capability addresses this recommendation?
- AMicrosoft Entra Access Reviews
- BMicrosoft Entra Privileged Identity Management (PIM)
- CMicrosoft Entra Conditional Access
- DMicrosoft Entra Identity Protection
Show answer & explanationAnswer & explanation
Correct answer: B. Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) and just-enough-access (JEA) to privileged roles, reducing the attack surface by ensuring these roles are active only when needed and for a limited duration.
Why the other options are wrong
- A. Access Reviews periodically certifies access, but PIM actively manages the lifecycle of privileged role assignments.
- C. Conditional Access enforces policies based on conditions, but doesn't manage the activation and deactivation of privileged roles.
- D. Identity Protection focuses on detecting and remediating identity-based risks, not managing privileged access duration.
Microsoft Entra Privileged Identity Management (PIM)
A service that manages, controls, and monitors access to important resources in Microsoft Entra ID, Azure, and other Microsoft Online Services, providing just-in-time and just-enough access.
- Enables just-in-time (JIT) access
- Provides role activation and deactivation
- Includes approval workflows and audit trails
Memory trick: Give the crown only when needed, and only for a moment.