Does Azure AD PIM Prompt Password Changes for Unknown IPs?
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet. You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to change passwords. Solution: You configure the use of Azure AD Privileged Identity Management. Does the solution meet the goal?
Community Insight
The question tests whether you can distinguish PIM (just-in-time privileged role administration) from Identity Protection (risk-based sign-in detection and remediation); the trap is assuming any Azure AD security feature satisfies a risk-detection requirement.
This AZ-900 case study asks whether configuring Azure AD Privileged Identity Management (PIM) forces password changes for users signing in from unidentified IP addresses. The answer is No, because that goal belongs to Azure AD Identity Protection sign-in risk policies, not PIM.
Choosing A (Yes) by treating Azure AD Privileged Identity Management as a general sign-in security tool, when PIM only governs time-bound, approval-based activation of privileged roles and never detects risky sign-ins or triggers password resets.
Community Discussion (26 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure AD Privileged Identity Management is exclusively an administrative-governance service: it provides just-in-time privileged access, time-bound and approval-based role activation, and audit history for elevated roles in Azure AD and Azure resources. Nothing in PIM inspects the network origin of an ordinary sign-in, so it cannot identify an "unidentified IP address" (such as an anonymous IP) or automatically challenge the user to change a password. Detecting anonymous IP addresses, unfamiliar sign-in properties, atypical travel, and leaked credentials, then applying a "require password change" or block/register-controls response, is the job of Azure AD Identity Protection sign-in risk policies. Because the proposed solution uses the wrong service, it does not meet the goal, making B the correct verdict.Why the Other Options Are Wrong
Option A (Yes) would require PIM to evaluate sign-in risk signals and trigger remediation, which is outside its documented function; PIM only manages eligibility and activation for privileged roles. Option A also ignores that the users described are ordinary users connecting over the internet, not privileged administrators being granted elevated roles. Conditional Access could be layered to act on Identity Protection's risk level, but Conditional Access alone is not what was configured here — PIM was. Every commenter who analyzed the service capabilities reached the same conclusion, so no option other than B survives scrutiny.Community Comment Notes
Buiducvu cited the Identity Protection sign-in risk policy documentation and listed the exact signals it detects, including "Anonymous IP address use," which precisely matches the scenario. Kahla summarized the core distinction well: PIM "manages access to privileged roles but does not detect risky sign-ins," with Identity Protection being the appropriate service. BinuRaj's top-voted comment reinforces this by describing PIM's scope as "time-based and approval-based role activation" for mitigating excessive or misused privileged permissions — nothing about sign-in risk. Kanders and Jas001 likewise concluded No, pointing to Identity Protection, and no commenter argued that PIM could satisfy the requirement.Official Reference
Exam Strategy
In scenario-based Yes/No questions, name the service's documented purpose in one phrase before judging; if the named service's purpose does not cover the stated requirement, the answer is No. Here, PIM = privileged role administration, Identity Protection = sign-in risk detection, so the mismatch is immediate.
Frequently Asked Questions
Which Azure AD service detects sign-in from an anonymous or unidentified IP address?
Azure AD Identity Protection, through its sign-in risk policy, detects signals such as anonymous IP address use, atypical travel, and leaked credentials, and can require a password change or block.
What does Azure AD Privileged Identity Management actually do?
PIM provides just-in-time, time-bound, and approval-based activation of privileged administrative roles in Azure AD and Azure, with audit records — it does not evaluate sign-in risk.
Related Analysis
Practice All AZ-900 Questions
Access 90 questions with complete answers and detailed explanations.
View Full AZ-900 Practice Test →