AZ-500 Practice Question: PIM activation settings are configured per role.
A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?
⚠ Common exam trap
Many candidates assume the presence of a ticket number field in the activation form means it is required, but PIM separates the UI display from the enforcement toggle, so the setting must be explicitly enabled for the field to be mandatory.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Require ticket information on activation' setting is not enabled in the role settings
The 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'Require ticket information on activation' setting is not enabled in the role settings
Why this is correct
The 'Require ticket information on activation' setting is a per-role toggle in PIM's role settings. When disabled, the activation flow omits the ticket number field entirely, so users can activate without supplying any justification. Even if the organization expects tickets, PIM will not enforce or even ask for one unless this specific setting is turned on. In the Azure portal, navigate to Privileged Identity Management > Roles > [Role] > Settings > Edit, and enable the 'Require ticket information on activation' checkbox per role.
- ✗
Users are activating through the Azure AD overview page instead of the PIM blade
Why it's wrong here
The entry point for activation does not alter PIM's underlying policy enforcement. Whether a user activates via the Azure AD overview page, the PIM blade, or the Microsoft Entra admin center, the same activation settings from the role's configuration are applied. If ticket information is required, the field appears regardless of the UI path; conversely, if it is not enabled, no entry point will prompt for it. Therefore, choosing a different portal page cannot bypass or suppress a properly configured PIM requirement.
- ✗
The activation policy requires approval but the approvers ignore the ticket field
Why it's wrong here
Approval workflows and ticket information are separate facets of activation. The ticket number is collected from the requesting user during the activation request, not from the approver during the approval step. Approvers see the request details, including any pre-filled ticket number, but they cannot supply one on behalf of the user. The real problem is that the setting is disabled, so the user never sees a ticket field to complete in the first place, making the approver's review process irrelevant to the missing ticket data.
- ✗
The role is configured for 'Active' assignment instead of 'Eligible'
Why it's wrong here
An 'Active' assignment grants the role permanently or for a fixed duration without requiring any activation step, meaning the user simply has the role. In contrast, an 'Eligible' assignment makes the user a candidate who must activate the role on demand, which is where PIM settings like ticket information apply. If the role were 'Active', the user would not be activating at all, so the scenario of activation being performed without a ticket would not exist. Thus, the assignment type is not the root cause; the configuration of the activation policy is what determines whether a ticket is requested.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.