A company wants administrators to hold no standing privileged role. Instead they should request elevation for a few hours, with approval and MFA, and every activation must be auditable. Which feature provides this?
Show answer and explanation
Answer: A
Privileged Identity Management turns a permanent role assignment into an eligible one. The user requests activation, supplies a justification, completes MFA, and where configured waits for an approver. PIM then creates a time-bound active assignment that expires automatically, and each step is written to the audit log. Role settings control the maximum duration, whether approval or a ticket number is required, and who may approve. This removes standing access while keeping a documented path to elevation.
Why the other options are wrong
- B. Conditional Access governs whether a sign-in or token request is allowed and under which controls. It does not model eligibility, approval workflows or time-bound role activation.
- C. Identity Protection detects risky users and sign-ins and feeds risk into Conditional Access. It does not grant or expire privileged roles.
- D. Access reviews periodically ask reviewers to confirm or remove existing access. They are a recertification control and do not provide just-in-time activation.
Exam tip. Just-in-time privilege with approval and expiry is PIM's defining purpose.