AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: pIM 'Require approval to activate' enforces a multi-party approval workflow.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They want the activation of this role to require approval from a specific group of senior security engineers before the role becomes active. They also want the approvers to receive an email notification when an activation request is submitted. Which PIM configuration must be set?
Why wrong: Maximum duration controls how long the role can be active, but does not require approval.
B
Require justification on activation.
Why wrong: Justification requires the user to provide a reason, but does not require approval from another person.
C
Require approval to activate.
Enabling 'Require approval' ensures that activation requests go to designated approvers. Notifications are sent automatically to approvers when a request is made.
D
Configure notification emails for role activation.
Why wrong: This setting controls emails to users, not the approval workflow. It does not enforce approval.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require approval to activate.
Option C is correct because Azure AD PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.
Key principle: PIM 'Require approval to activate' enforces a multi-party approval workflow.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Set the activation maximum duration to 1 hour.
Why it's wrong here
Maximum duration controls how long the role can be active, but does not require approval.
✗
Require justification on activation.
Why it's wrong here
Justification requires the user to provide a reason, but does not require approval from another person.
✓
Require approval to activate.
Why this is correct
Enabling 'Require approval' ensures that activation requests go to designated approvers. Notifications are sent automatically to approvers when a request is made.
Related concept
PIM 'Require approval to activate' enforces a multi-party approval workflow.
✗
Configure notification emails for role activation.
Why it's wrong here
This setting controls emails to users, not the approval workflow. It does not enforce approval.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'Configure notification emails for role activation' (Option D) with the approval workflow, not realizing that notifications are automatically sent when approval is required, and that the approval setting itself is the key to both the approval and notification requirements.
Detailed technical explanation
How to think about this question
Under the hood, PIM uses Azure AD's approval workflow engine, which integrates with Microsoft Graph and Azure AD audit logs. When 'Require approval to activate' is enabled, PIM creates an approval request object that approvers can review via the Azure portal, Microsoft Entra admin center, or email. A subtle behavior is that the notification email to approvers is automatically sent only when approval is required; if approval is not required, notification settings for role activation must be configured separately.
KKey Concepts to Remember
PIM 'Require approval to activate' enforces a multi-party approval workflow.
Approvers designated in PIM automatically receive email notifications for pending requests.
This setting prevents direct role activation without explicit consent from configured approvers.
Approval workflows are configured per role within Azure AD PIM settings.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
PIM 'Require approval to activate' enforces a multi-party approval workflow.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review pIM 'Require approval to activate' enforces a multi-party approval workflow., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — PIM 'Require approval to activate' enforces a multi-party approval workflow..
What is the correct answer to this question?
The correct answer is: Require approval to activate. — Option C is correct because Azure AD PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.
What should I do if I get this AZ-500 question wrong?
Review pIM 'Require approval to activate' enforces a multi-party approval workflow., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
PIM 'Require approval to activate' enforces a multi-party approval workflow.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.