AZ-500 Practice Question: PIM settings are configured per role in Azure AD.
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: pIM settings are configured per role in Azure AD.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Privileged Identity Management (PIM) for Azure AD roles. They want to require that users must perform multi-factor authentication (MFA) when activating a role. Which PIM setting should they configure?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require Azure AD Multi-Factor Authentication on activation
To enforce multi-factor authentication during role activation in Azure AD Privileged Identity Management (PIM), you must configure the 'Require Azure AD Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.
Key principle: PIM settings are configured per role in Azure AD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Require Azure AD Multi-Factor Authentication on activation
Why this is correct
This setting enforces MFA every time a user activates a role, adding an extra layer of security.
This setting requires one or more designated approvers to approve the activation, but does not specifically enforce MFA.
✗
Require justification on activation
Why it's wrong here
This requires users to provide a business reason for activation, but does not enforce MFA.
✗
Require ticket information on activation
Why it's wrong here
This requires users to provide a ticket number from a ticketing system, but does not enforce MFA.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'Require approval to activate' with MFA enforcement, but approval is a separate authorization step that does not verify the user’s identity through a second factor.
Detailed technical explanation
How to think about this question
When 'Require Azure AD Multi-Factor Authentication on activation' is enabled, PIM triggers an Azure AD Conditional Access policy that evaluates the user’s session and forces MFA via the Microsoft Authenticator app, phone call, or SMS. This setting is independent of the user’s existing MFA registration status; if the user is not already registered for MFA, they will be prompted to register during activation. In a real-world scenario, this prevents a compromised primary credential from being used to activate a highly privileged role like Global Administrator.
KKey Concepts to Remember
PIM settings are configured per role in Azure AD.
MFA on activation adds an extra layer of security for privileged roles.
This setting enforces MFA even if the user is already signed in.
It helps prevent unauthorized privilege escalation from compromised credentials.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
PIM settings are configured per role in Azure AD.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Manage identity and access — This question tests Manage identity and access — PIM settings are configured per role in Azure AD..
What is the correct answer to this question?
The correct answer is: Require Azure AD Multi-Factor Authentication on activation — To enforce multi-factor authentication during role activation in Azure AD Privileged Identity Management (PIM), you must configure the 'Require Azure AD Multi-Factor Authentication on activation' setting. This ensures that before a user’s role assignment is activated, they must complete an MFA challenge, adding an extra layer of security against unauthorized access.
What should I do if I get this AZ-500 question wrong?
Review pIM settings are configured per role in Azure AD., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
PIM settings are configured per role in Azure AD.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.