A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Wait for the role assignment to propagate to Azure.

Propagation is not the issue when the role is eligible but currently inactive.

Create a new security group and assign Contributor directly.

This bypasses the workflow instead of using the existing privileged access process.

Sign out of the portal and sign back in only.

Refreshing the token alone does not activate a role that still needs PIM approval.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Activate the eligible role through Privileged Identity Management and obtain approval if required. — An eligible Privileged Identity Management assignment is not usable until the user activates it. If the configuration requires approval, the request must also be approved before the role becomes active. Once activated, the permissions are time-bound and expire at the end of the window. The contractor needs to use the PIM activation workflow again rather than expecting the role to work continuously like a permanent assignment. Why others are wrong: Propagation delays do not explain an eligible-but-inactive role. Creating a new group sidesteps the governance control and is not the correct operational fix. Signing out and back in can refresh cached claims, but it cannot activate a role that still requires PIM approval and a valid activation window.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.