Microsoft Certified: Azure Solutions Architect ExpertDesign identity, governance, and monitoring solutionsMedium
A global pharmaceutical company is deploying a new research application to Azure. The application will store highly sensitive patient trial data. Regulatory compliance dictates that all access to this data must be explicitly granted and revoked, and that access permissions must be time-limited and require multi-factor authentication (MFA) approval for activation. Which Azure service should be used to enforce these requirements for Azure resource access?
- AAzure Active Directory Conditional Access
- BAzure Role-Based Access Control (RBAC)
- CAzure Security Center
- DAzure Active Directory Privileged Identity Management (PIM)
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Active Directory Privileged Identity Management (PIM)
Azure PIM provides just-in-time (JIT) access, time-bound access, approval workflows, and MFA enforcement for role activation, directly addressing all the stated requirements for sensitive data access in a highly regulated environment.
Why the other options are wrong
- A. Conditional Access policies can enforce MFA and device compliance, but they do not provide time-limited role activation or an approval process for elevating permissions.
- B. RBAC defines static roles and assignments but does not provide time-limited access, JIT activation, or approval workflows for role elevation.
- C. Azure Security Center (now Defender for Cloud) focuses on security posture management and threat protection, not on managing just-in-time access or approval workflows for user roles.
Azure PIM
Azure Privileged Identity Management (PIM) is an Azure AD service that enables you to manage, control, and monitor access to important resources in Azure AD, Azure, and other Microsoft online services.
- Provides just-in-time (JIT) privileged access
- Enforces time-bound access for roles
- Supports approval workflows for role activation
- Can require MFA for role activation
Memory trick: PIM Protects Important Members with Time and MFA.