AZ-500 Manage identity and access Practice Question
A company uses Microsoft Entra Privileged Identity Management (PIM) for the Global Administrator role. They want to ensure that when a user activates the role, the activation request must be approved by a member of the 'Global Admin Approvers' group, and the activation should be time-bound with a maximum of 4 hours. Which PIM settings should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse 'require approval' with 'require MFA' or 'require justification', not realizing that approval is a distinct setting that must be explicitly configured to meet the requirement for a designated approver group.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.
Microsoft Entra PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.
Why this is correct
Setting the activation maximum duration to 4 hours directly enforces the time limit requirement in PIM's role settings, while requiring approval from the 'Global Admin Approvers' group ensures that every activation request is explicitly reviewed and approved before the role becomes active. This is the only option that fully aligns with both stated conditions: a 4-hour window and an approval workflow with the designated group.
- ✗
Set the activation maximum duration to 4 hours and enable MFA on activation.
Why it's wrong here
While enabling MFA on activation adds a strong authentication requirement, it does not enforce any approval from the 'Global Admin Approvers' group. In PIM, MFA and approval are independent conditions; an activation request could pass MFA but still be activated automatically, without human oversight, thus failing the approval requirement.
- ✗
Set the activation to require a ticket number justification and set the maximum duration to 8 hours.
Why it's wrong here
Requiring a ticket number justification forces users to provide a business reason, and setting the maximum duration to 8 hours technically exceeds the required 4-hour limit. More importantly, no approval from the 'Global Admin Approvers' group is configured, so this option lacks the necessary human approval step and also misses the precise duration constraint.
- ✗
Set the role to be permanently active but with a just-in-time approval workflow.
Why it's wrong here
A permanently active assignment means the user always holds the role without any activation process, so there is no just-in-time activation and no opportunity for an approval workflow to govern role activation. This directly contradicts the concept of JIT access—permanent assignments are always active and do not require or support approval-based activation.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.