AZ-305 Practice Question: Design identity, governance, and monitoring solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Select role, Configure settings, Assign eligible members, Set notifications, Test activation

  Why this is correct

  This is the correct order because you must first select the role to manage, then configure its PIM settings (e.g., activation duration, approval requirements), then assign eligible members, set up notifications for activations, and finally test the activation process to ensure everything works.

• ✗

  Select role, Assign eligible members, Configure settings, Set notifications, Test activation

  Why it's wrong here

  Selecting a role and immediately assigning eligible members before configuring PIM settings is incorrect because role settings define activation constraints such as maximum duration, approval workflow, MFA on activation, and just-in-time elevation policy. Assigning members first means those assignments inherit whatever settings are currently in place (possibly default or overly permissive), rather than the intended governance requirements. You must first select the role, then configure its settings to match security policy, and only then assign eligible members so they activate under the correct terms.

• ✗

  Configure settings, Select role, Assign eligible members, Set notifications, Test activation

  Why it's wrong here

  This sequence fails because 'Configure settings' cannot be performed in a vacuum—PIM requires you to first select the specific role (e.g., Global Administrator) whose settings you are editing. The settings blade for a role is only accessible after the role is chosen from the Microsoft Entra ID roles page. Without that selection, there is no target context for the configuration step, so placing 'Configure settings' before 'Select role' is logically impossible in the PIM interface.

• ✗

  Select role, Configure settings, Set notifications, Assign eligible members, Test activation

  Why it's wrong here

  Positioning 'Set notifications' before 'Assign eligible members' is flawed because notifications in PIM are triggered by events such as member assignments, activation requests, or role activations; if no eligible members exist yet, there is nothing to notify about and the notification configuration cannot be validated or role-specific recipients tailored. Notifications also support alerting administrators when specific members activate, so the membership list must be known to configure meaningful rules. The correct order is to assign eligible members first, then configure notifications, then test activation.

Go deeper

Related to this question