A county assessor's office needs just-in-time elevation for a privileged role during a weekend outage. Which capability fits?

A county assessor’s office needing just-in-time elevation for a privileged role during a weekend outage should use Privileged Identity Management to activate eligible roles when needed. PIM supports time-bound activation so on-call staff can elevate for the outage window, then return to least privilege when the activation expires—unlike using Privileged Identity Management to assign standing active roles for the outage period, which leaves the role turned on after the outage ends.

Using Privileged Identity Management to assign standing active roles for the outage period still leaves privileged access in place after the outage ends, which is the standing-privilege problem just-in-time activation is meant to avoid. Using entitlement management to activate eligible admin roles when needed for the outage is the wrong tool, because entitlement management governs access packages to resources and cannot activate eligible Microsoft Entra admin roles, which requires PIM eligible activation. Using a Conditional Access policy to elevate eligible role assignments when needed for the outage cannot elevate roles; it only enforces sign-in conditions, so it does not grant or time-bound the privileged role activation itself and cannot serve as just-in-time elevation.

Exam caveat: Weekend/outage scenarios still map to PIM eligible activation, not to assigning standing active roles in PIM, entitlement management activation of eligible admin roles, or Conditional Access elevation alone. AB-900 tests whether you keep least privilege under operational pressure.

Operational check: Before the weekend, ensure outage responders are PIM-eligible for the minimum roles required, test activation including MFA, document approval requirements if any, activate only for the outage duration, and review PIM activation logs on Monday for unexpected elevations.