A security team must receive a notification whenever an administrator activates an eligible Microsoft Entra directory role, so the activation can be reviewed promptly. Which capability should the team configure?
Show answer and explanation
Answer: A
Privileged Identity Management includes built-in alerts and notification settings that fire when a user activates an eligible role, and those notifications can go directly to designated recipients. Because PIM generates the alert itself, the team does not have to write queries or maintain custom rules. The other options either report on access periodically, cover virtual machines rather than directory roles, or depend on scheduled queries that add delay.
Why the other options are wrong
- B. Access reviews verify that continued access is still needed on a schedule. They do not notify anyone when an activation happens, so the activation would only surface at the next review campaign.
- C. Just-in-time VM access controls inbound network ports on virtual machines. It does not monitor directory role activations, so it cannot alert on Entra administrator role use.
- D. A scheduled hourly query introduces delay and requires the team to maintain custom detection logic. It is not the immediate, purpose-built notification the requirement describes.