AB-900 practice question 7 of 35

Your tenant currently has over 30 users permanently assigned to high-privilege roles such as Global Administrator and Privileged Role Administrator…

Choose your answer, then check it against the explanation and the full breakdown below.

Your tenant currently has over 30 users permanently assigned to high-privilege roles such as Global Administrator and Privileged Role Administrator “to avoid delays.” A red team exercise demonstrates that compromising any one of these accounts gives long-term control of the environment with no time limits, approvals, or additional prompts. Leadership asks for a solution that enforces just-in-time admin access, requires elevation to be time-bound, and records every activation for audit. Which feature should you implement ﬁrst to address these requirements?

Answer options

Correct Answer:

Explanation

Microsoft Entra Privileged Identity Management (PIM) is designed specifically to address the risks of standing administrative access. It enforces just-in-time (JIT) access, requiring users to request and justify elevation into a privileged role. Access is time-bound, automatically revoking permissions after a configured duration. PIM also provides a comprehensive audit trail of all activation requests, approvals, and activities performed while elevated, directly meeting all of the stated requirements from leadership to mitigate the identified security risks.

Why Incorrect

A. Microsoft Entra Conditional Access enforces access policies at sign-in but does not manage just-in-time role elevation or time-bound assignments.

C. Administrative units are used to delegate and scope administrative permissions to specific subsets of an organization, not to manage the activation of those permissions.

D. Privileged access groups are a feature within PIM. Implementing PIM itself is the comprehensive solution, not just one of its components.

References

1. Microsoft Learn. (2024). What is Microsoft Entra Privileged Identity Management?. "What does it do?" section. This document states that PIM provides "just-in-time privileged access

" "time-bound access

" and requires "approval to activate privileged roles."

2. Microsoft Learn. (2024). Deploy Microsoft Entra Privileged Identity Management (PIM). "Plan the deployment" section. This guide positions PIM as the primary tool to "manage

control

and monitor access to important resources

" directly addressing the scenario's need to move away from permanent admin assignments.

Question 7 of 35

Question breakdown

Tests: Describe privileged access management with Microsoft Entra PIM
Difficulty: Easy

Key idea: Privileged Identity Management replaces standing admin assignments with eligible roles that users activate just-in-time, for a limited time, with every activation audited.

How to reach the answer

The problem is permanent assignments to high-privilege roles that never expire.
Leadership's requirements are just-in-time access, time-bound elevation, and an audit record of every activation.
Those three requirements match the purpose of Privileged Identity Management (PIM): eligible assignments, an activation duration, optional approval or MFA, and an audit history.
Conditional Access and administrative units do not control when roles are activated, so PIM is the right first step.

Each option

AIncorrect. Conditional Access sets conditions at sign-in but does not convert permanent role assignments into time-limited activations.
BCorrect. PIM provides just-in-time, time-bound role activation with approval and a full audit trail.
CIncorrect. Administrative units limit which objects an admin can manage, not when or for how long the admin role is active.
DIncorrect. PIM for groups is one capability within PIM; it does not on its own address directory role activation across the tenant.

Common trap: Conditional Access is tempting because it is the best-known Entra security control and can require MFA, but it cannot make a role assignment time-bound.

In practice: A common hardening step is moving most Global Administrators to eligible assignments in PIM with approval and 1–8 hour activation windows. Organizations typically keep two break-glass accounts as permanent assignments.

Remember: When a question mentions just-in-time, time-bound elevation, or activation audit, the answer is PIM.

Official documentation: What is Microsoft Entra Privileged Identity Management?

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free AB-900 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test