AZ-500 Manage identity and access Practice Question
A company uses Microsoft Entra Privileged Identity Management (PIM) for Microsoft Entra ID roles. They want to require that users must perform multi-factor authentication (MFA) when activating a role. Which PIM setting should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse 'Require approval to activate' with MFA enforcement, but approval is a separate authorization step that does not verify the user’s identity through a second factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require Microsoft Entra ID Multi-Factor Authentication on activation
To enforce multi-factor authentication during role activation in Microsoft Entra Privileged Identity Management (PIM), you must configure the 'Require Microsoft Entra ID Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require Microsoft Entra ID Multi-Factor Authentication on activation
Why this is correct
This setting enforces Microsoft Entra ID Multi-Factor Authentication during the role activation process, so an eligible user must prove possession of a second factor (e.g., Authenticator app, phone call, FIDO2 key) each time they activate a privileged role. Because activation is time-bound, MFA at this step reduces the risk that a stolen primary credential alone can grant elevated access. In PIM, this is a mandatory best practice for highly privileged roles like Global Administrator.
- ✗
Require approval to activate
Why it's wrong here
Requiring approval creates a manual review workflow where one or more specified approvers must accept the activation request before the role becomes active. However, this is a governance and separation-of-duties control, not an authentication control; it does nothing to verify the identity of the user making the request. An attacker with valid credentials could still request access, and if the approver approves, no MFA challenge is enforced.
- ✗
Require justification on activation
Why it's wrong here
This option requires the user to type a business justification into the activation request, which is recorded in the audit logs. The justification is not verified against any external source, nor does it require any additional proof of identity, so it provides no second authentication factor. It is useful for accountability and post-incident review but cannot fulfill an MFA requirement.
- ✗
Require ticket information on activation
Why it's wrong here
Requiring ticket information forces the user to enter a valid ticket number from a corporate ticketing system during activation, useful for aligning elevated access with change requests. However, PIM only checks that the field is populated, not that the ticket is valid or that the user is authorized to use it, and it does not use any cryptographic or authentication method. This is an operational control for traceability, not an MFA method.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.