To reduce standing privileged access, admins should be 'eligible' for Global Administrator and activate it only when needed, with approval and time limits. Which feature provides this?
A.Conditional Access
Conditional Access applies conditions to sign-ins — not role elevation workflows.
B.Privileged Identity Management (PIM)
PIM = JIT privileged role activation. Correct.
C.Administrative units
Administrative units scope admin authority — not activation workflow.
D.Entra ID access reviews
Access reviews recertify membership — no time-bound activation.
Why this answer
PIM (P2 feature) provides just-in-time privileged access: eligible assignments activated on demand with MFA, approval, justification, and time-bound expiry — plus audit history. This is the 'least privilege, zero standing admin' mechanism.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Identity & Governance practice session.
Practice Identity & Governance