Exam SC-300 topic 4 question 66 discussion

To evaluate and remediate the risks associated with highly privileged accounts across multiple Azure subscriptions linked to a single Microsoft Entra tenant, you should use Privileged Identity Management (PIM) (Option B). Microsoft Entra PIM provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. It helps you manage, control, and monitor access within your organization, which includes access to Azure resources and other Microsoft services. Please note that while Microsoft Entra Permissions Management can provide visibility into permissions across multicloud infrastructures, it doesn’t specifically target the management of highly privileged accounts. Global Secure Access and Microsoft Entra Verified ID do not provide the specific capabilities required for this scenario.

Answer is C

Answer: B. I was torn between B and C. Lots of back and forth between a couple diff AI's turned up the below. PIM's direct focus on the lifecycle management of privileged roles within the Microsoft Entra tenant and its linked subscriptions, along with its built-in workflows and centralized control, likely leads to a solution that minimizes administrative effort more effectively for this specific requirement. Therefore, while Permissions Management excels at evaluating risk, Privileged Identity Management (PIM) (Option B) likely better addresses the requirement to minimize administrative effort while still providing significant capabilities for evaluating (through visibility of assignments) and remediating (through control) risks associated with highly privileged accounts within the specified Microsoft Entra tenant and its linked Azure subscriptions.

Answer C) Microsoft Entra Permissions Management https://learn.microsoft.com/en-us/entra/permissions-management/

To evaluate and remediate the risks associated with highly privileged accounts while minimizing administrative effort, you should use Microsoft Entra Permissions Management. This tool provides a comprehensive solution for managing permissions and roles across multiple cloud environments, including Azure

I think it's got to be C. in the description: "Discover Customers can assess permission risks by evaluating the gap between permissions granted and permissions used." " Remediate Customers can right-size permissions based on usage, grant new permissions on-demand, and automate just-in-time access for cloud resources." https://learn.microsoft.com/en-us/entra/permissions-management/overview. I don't see how PIM does anything to "evaluate" risk.

it doesn't matter if its multi-cloud or not, Entra Permissions Management can be used for Azure only without onboarding AWS or GCP. The answer is C as it provides this centralized location where we can easily check and fix the issues with permissions that have higher privileges..

Only if the question asks about multi cloud, then I would go for C "Entra Permission Management". Else just within Azure, PIM would suffice.

La respuesta es la B

Could make a case for PIM, but I think Microsoft wants to hear Permission Management. The only thing that may not make it Permission Management is that it doesn't say multi-cloud.