AZ-500 Require approval setting Practice Question
A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that activation of this role must be approved by a designated group of security engineers before it becomes active. Which PIM role setting should they configure?
⚠ Common exam trap
It's easy for candidates to confuse 'Require justification' or 'MFA on activation' with approval workflows, but neither introduces a separate approval step by a designated group—they only add authentication or logging requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require approval
Azure AD PIM's 'Require approval' setting enforces that a designated group of approvers must authorize each activation request before the role becomes active. This directly meets the requirement for approval by security engineers, ensuring that role activation is gated by explicit consent rather than being automatic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Activation maximum duration (hours)
Why it's wrong here
This setting controls how long a role activation remains valid, typically between 0.5 and 8 hours (or custom based on policy). It only defines the time window for which the user has elevated access after activation; it does not involve any human review or approval step. Even if the duration is set to the maximum, the user can still activate instantly without anyone else's consent, so it does not satisfy the requirement for approval-based control.
- ✗
MFA on activation
Why it's wrong here
This setting requires the user to complete Azure AD Multi-Factor Authentication at the moment they activate the eligible role. MFA verifies the user's identity, not the appropriateness or business need for the elevation. It does not bring in a second person or designated approver to review and approve the activation request; therefore, it cannot fulfill a requirement that a security team must approve every activation.
- ✓
Require approval
Why this is correct
Enabling 'Require approval' in PIM role settings means that when an eligible user requests activation, the request enters a pending state and a designated set of approvers (e.g., security team members) must explicitly approve or reject it before the role is activated. This provides an extra layer of human oversight, ensuring that no one can elevate their privileges without another party's review. This is the only setting among the four that directly implements an approval workflow.
- ✗
Require justification on activation
Why it's wrong here
This setting forces the user to enter a text justification (e.g., ticket number, reason) when requesting role activation. While this is useful for auditing and for helping approvers later, the justification alone does not stop the activation; the role becomes active immediately as long as the justification meets any validation rules (e.g., minimum length). It does not by itself involve any other person's approval, so it must be combined with 'Require approval' to actually enforce an approval gate.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.