Microsoft 365 Certified: Administrator ExpertDeploy and manage a Microsoft 365 tenantHard
A Microsoft 365 administrator is auditing the roles assigned to users in their tenant. They discover that several users have been assigned the 'Global Administrator' role for an extended period, which violates the company's least privilege policy. The administrator wants to ensure that these highly privileged roles are assigned only when needed and for a limited duration, requiring explicit activation and approval. Which Azure AD feature should the administrator implement?
- AAzure AD Privileged Identity Management (PIM)
- BAzure AD Identity Protection
- CAzure AD Conditional Access policies
- DAzure AD Access Reviews
Show answer & explanationAnswer & explanation
Correct answer: A. Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources. It provides just-in-time and time-bound access to privileged roles, requiring activation and approval, which directly addresses the company's requirement to enforce least privilege for highly privileged roles.
Why the other options are wrong
- B. Identity Protection detects and remediates identity-based risks, but doesn't manage the assignment or activation of privileged roles.
- C. Conditional Access policies control *how* users access resources, not the lifecycle of privileged role assignments.
- D. Access Reviews are for periodically verifying existing access, but don't manage just-in-time access or activation requirements.
Azure AD Privileged Identity Management (PIM)
An Azure AD feature that allows organizations to manage, control, and monitor access to important resources by providing just-in-time and time-bound access to privileged roles.
- Enforces 'just-in-time' (JIT) and 'just-enough-access' (JEA) principles.
- Requires activation and optional approval for privileged roles.
- Provides audit trails and access reviews for privileged role assignments.
Memory trick: PIM is like a secure vault for your admin keys, only opening when needed and for a short time.