CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Temporary Access in Azure: A Walkthrough of AZ-500 Exam Question
Explore a key AZ-500 exam question on temporary access in Azure. Understand why Azure AD PIM is the answer.
When preparing for the AZ-500 exam, candidates often trip over questions about temporary access management. Understanding the tools available can make the difference between passing and failing.
The question
A company needs to provide temporary access to a vendor for specific resources in Azure. You want to ensure that this access is limited to a certain time period and automatically revoked afterward. What should you use?
A. Azure Role-Based Access Control (RBAC) with a custom role
B. Azure AD Privileged Identity Management (PIM)
C. Azure AD Conditional Access policies
D. Azure AD Security Groups
Think before you scroll
Consider the requirements for temporary access. You need a solution that supports time-limited permissions and automatic revocation. This narrows the options significantly, as not all choices provide these features.
The answer
The correct option is B. Azure AD Privileged Identity Management (PIM). Azure AD PIM is specifically designed to manage, control, and monitor access within Azure AD, allowing for time-limited access. This fits the need for temporary permissions perfectly.
Why the other options lose
A. Azure Role-Based Access Control (RBAC) with a custom role: While RBAC allows you to define roles and permissions, it does not have built-in expiration for access. This means that once a role is assigned, it remains until manually removed, making it unsuitable for temporary access.
C. Azure AD Conditional Access policies: Conditional Access is focused on enforcing security policies based on conditions like user location or device compliance. It does not handle time-limited access directly, which is essential in this scenario.
D. Azure AD Security Groups: Security Groups are used to manage user access to resources based on group membership. They do not offer time-limited access capabilities and are not designed for temporary permissions.
The concept behind it
Understanding how Azure AD PIM operates is crucial. It allows for just-in-time access, meaning users can request permissions for a limited time. This is particularly useful for vendors or contractors who need temporary access to resources without the risk of lingering permissions after their work is done.
Exam trap to remember
Remember the key feature of Azure AD PIM: it provides time-limited access that automatically revokes permissions. This principle is essential for managing temporary access securely.