The answer is the Activation settings within the Azure AD PIM role configuration. This is correct because the Activation settings blade specifically controls the conditions under which an eligible user can activate a role, including the mandatory justification field and the maximum activation duration in hours. By configuring these settings, you can enforce a requirement for a support ticket number in the justification and cap the activation at 4 hours, directly addressing the need for both justification and duration control. On the AZ-500 exam, this question tests your understanding of the distinction between Activation settings, which govern the activation process itself, and other settings like Assignment or Notification settings, which handle different lifecycle aspects. A common trap is confusing Activation settings with Role settings or Eligibility settings, but remember that any requirement tied to the moment of activation—such as justification, approval, or time limits—lives exclusively under Activation. Memory tip: “Activation is the gatekeeper” — if it happens when the user clicks “Activate,” it’s an Activation setting.
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: pIM Activation settings define how an eligible role is activated.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?
In the activation settings for the role, you can set maximum duration (4 hours) and require justification with a ticket number field.
B
Notification settings
Why wrong: Notification settings control who receives emails when a role is activated or assigned, not the activation parameters.
C
Approval settings
Why wrong: Approval settings require approval from designated approvers. While they can require a ticket number, the maximum activation duration is set in activation settings.
D
Assignment settings
Why wrong: Assignment settings define the start and end dates for eligible or active assignments, not the activation behavior.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activation settings
Option A is correct because the 'Activation settings' in Azure AD PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.
Key principle: PIM Activation settings define how an eligible role is activated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Activation settings
Why this is correct
In the activation settings for the role, you can set maximum duration (4 hours) and require justification with a ticket number field.
Related concept
PIM Activation settings define how an eligible role is activated.
✗
Notification settings
Why it's wrong here
Notification settings control who receives emails when a role is activated or assigned, not the activation parameters.
✗
Approval settings
Why it's wrong here
Approval settings require approval from designated approvers. While they can require a ticket number, the maximum activation duration is set in activation settings.
✗
Assignment settings
Why it's wrong here
Assignment settings define the start and end dates for eligible or active assignments, not the activation behavior.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'Assignment settings' (which control the duration of an eligible or active assignment) with 'Activation settings' (which control the duration and conditions of activation for eligible users), leading them to incorrectly select Option D.
Detailed technical explanation
How to think about this question
Under the hood, PIM activation settings are stored as part of the role's policy in Azure AD, and when a user activates a role, the system validates the provided justification against the configured requirements (e.g., mandatory fields) and enforces the maximum activation duration via a time-bound token. In real-world scenarios, requiring a support ticket number in justification helps organizations audit role activations against incident management systems, ensuring compliance with change management policies.
KKey Concepts to Remember
PIM Activation settings define how an eligible role is activated.
Maximum activation duration is configured in Activation settings.
Justification requirements, including specific fields like ticket numbers, are set here.
Activation settings are crucial for 'just-in-time' access enforcement.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
PIM Activation settings define how an eligible role is activated.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Review pIM Activation settings define how an eligible role is activated., then practise related AZ-500 questions on the same topic to reinforce the concept.
Manage identity and access — This question tests Manage identity and access — PIM Activation settings define how an eligible role is activated..
What is the correct answer to this question?
The correct answer is: Activation settings — Option A is correct because the 'Activation settings' in Azure AD PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.
What should I do if I get this AZ-500 question wrong?
Review pIM Activation settings define how an eligible role is activated., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
PIM Activation settings define how an eligible role is activated.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A privileged administrator should activate the Security Administrator role only for approved work and for a limited time. What should be configured?
medium
A.Permanent active assignment in Microsoft Entra ID
✓ B.Eligible assignment with activation controls in Privileged Identity Management
C.Owner role at the subscription root
D.Conditional Access session persistence
Why B: Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure eligible assignments for roles like Security Administrator. This means the user must activate the role on demand, with time-bound activation controls (e.g., maximum activation duration, approval, MFA), ensuring the role is used only for approved work and for a limited time. This directly meets the requirement of just-in-time (JIT) access and temporary activation.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.