A Microsoft Entra service that provides just-in-time, time-bound privileged access to Entra and Azure roles. An "eligible" user must activate the role when needed, and activation can require MFA, approval, and justification.
In SC-900 it appears under Entra ID Governance and applies the least privilege principle. It requires Microsoft Entra ID P2 or Entra ID Governance. Key difference: eligible assignment (must be activated) vs. active (immediate permissions).
Privileged Identity Management (PIM) is a concept that can show up on the exam. Check the full guide to see it in context.