How to Configure PIM Activation Settings for Role Justification and Duration
A company uses Microsoft Entra Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?
Quick Answer
The answer is the Activation settings within the Azure AD PIM role configuration. This is correct because the Activation settings blade specifically controls the conditions under which an eligible user can activate a role, including the mandatory justification field and the maximum activation duration in hours. By configuring these settings, you can enforce a requirement for a support ticket number in the justification and cap the activation at 4 hours, directly addressing the need for both justification and duration control. On the AZ-500 exam, this question tests your understanding of the distinction between Activation settings, which govern the activation process itself, and other settings like Assignment or Notification settings, which handle different lifecycle aspects. A common trap is confusing Activation settings with Role settings or Eligibility settings, but remember that any requirement tied to the moment of activation—such as justification, approval, or time limits—lives exclusively under Activation. Memory tip: “Activation is the gatekeeper” — if it happens when the user clicks “Activate,” it’s an Activation setting.
⚠ Common exam trap
Many exam-takers confuse 'Assignment settings' (which control the duration of an eligible or active assignment) with 'Activation settings' (which control the duration and conditions of activation for eligible users), leading them to incorrectly select Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activation settings
The 'Activation settings' in Microsoft Entra PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Activation settings
Why this is correct
Activation settings in Microsoft Entra ID PIM control what happens when an eligible user activates a role, including requiring justification such as a support ticket number and enforcing a maximum activation duration. Configuring these satisfies both the ticket-justification and four-hour duration constraints.
- ✗
Notification settings
Why it's wrong here
Notification settings only control alerts sent when eligible roles are activated or assigned; they cannot enforce justification content or activation duration. It is tempting because alerts relate to activation events, but the requirement needs the role setting that governs activation itself.
- ✗
Approval settings
Why it's wrong here
Approval settings only require a designated approver to authorise activation; they do not mandate a support ticket number in the justification or cap activation at four hours. It is tempting because approvals also occur during activation, but the stem specifies justification content and duration, not approver consent.
- ✗
Assignment settings
Why it's wrong here
Assignment settings control who is eligible, whether assignment is permanent or time-bound, and assignment duration, not activation-time justification or activation length. It is tempting because duration appears in both, but assignment duration governs eligibility, not the four-hour activation window.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A privileged administrator should activate the Security Administrator role only for approved work and for a limited time. What should be configured?
medium- A.Permanent active assignment in Microsoft Entra ID
- ✓ B.Eligible assignment with activation controls in Privileged Identity Management
- C.Owner role at the subscription root
- D.Conditional Access session persistence
Why B: Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure eligible assignments for roles like Security Administrator. This means the user must activate the role on demand, with time-bound activation controls (e.g., maximum activation duration, approval, MFA), ensuring the role is used only for approved work and for a limited time. This directly meets the requirement of just-in-time (JIT) access and temporary activation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.