A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

This would bypass the intended governance model and grant far more access than needed. It also changes the security design instead of resolving the immediate activation issue. The problem is not missing Owner permissions; it is that the eligible role has not been activated.

Wait for Azure Policy compliance evaluation to finish before trying again.

Policy compliance evaluation does not activate PIM roles. Azure Policy can deny deployments, but the specific error here indicates an inactive role assignment, which is an authorization workflow issue. Waiting will not satisfy the activation requirements.

Remove the user from the security group and add them back so the role becomes active.

Recycling group membership does not replace the PIM activation workflow. The group assignment is already present; it is simply eligible, not active. Adding and removing the user would not satisfy MFA, justification, or approval requirements.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Activate the eligible role assignment in Privileged Identity Management. — When a role assignment is eligible in PIM, access is not granted until the user activates it. If the tenant requires justification, MFA, and approval, those conditions must also be completed during activation. The portal showing the role does not mean the user can use it yet. Once the role is active and the required checks are satisfied, the deployment can proceed. Why others are wrong: Granting Owner, waiting for policy, or cycling group membership does not address the inactive PIM state. Those actions either overprivilege the user or solve a different problem entirely. The real fix is activation plus the configured approval and MFA requirements.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.