Exam AZ-900 topic 1 question 30 discussion

Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment

Correct service would be Azure AD Identity Protection.

Azure AD Privileged Identity Management manages access to privileged roles but does not detect risky sign-ins or automatically prompt users to change passwords when signing in from unknown IP addresses. Azure AD Identity Protection is the appropriate solution for that goal.

It is Entra ID portection. https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection

No, the solution does not meet the goal.

PIM does not provide risk-based conditional policies for password changes, the solution does not meet the goal

Azure AD Identity Protection.

Azure AD identity protection

Entra ID Protection is the answer

The answer is B. APIM is not used to force to change password if logged from unknow IP. It is Conditional Access that can be used to force pwd change.

Azure Identity Protection will work, not need for Azured AD privileged identity mananagement

B

To address the goal of automatically encouraging users to change passwords when connecting to Azure AD from an unidentified IP address, you can leverage Azure AD Conditional Access policies. Azure AD Conditional Access allows you to define access control policies based on various conditions, including the user's location or network location.

yes the answer is right and it is B:NO bcz Azure AD Identity Protection does the job

the answer is NO it's only the AIP

B. No - PIM is not necessary in this scenario. The Azure Identity Protection will suffice.

B. https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy Identity Protection detects risks of many types, including: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray and more...