AZ-500 PIM approval workflow Practice Question
A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?
⚠ Common exam trap
Test-takers frequently think 'Require justification on activation' alone satisfies the requirement, but the question explicitly asks for approval by a specific group, which requires the separate 'Require approval to activate' setting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Require approval to activate' and select the security group as approver
The scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Require approval to activate' and select the security group as approver
Why this is correct
Enabling 'Require approval to activate' in PIM forces any eligible user's activation request to enter a pending state until a designated approver explicitly approves it. By selecting the security group as the approver, you guarantee that a human decision point exists outside the requesting user, so the security group enforces separation of duties. This is the native, built-in PIM approval mechanism that directly implements the required governance control.
- ✗
Set 'Require Azure Multi-Factor Authentication' to 'On'
Why it's wrong here
Setting 'Require Azure Multi-Factor Authentication' to 'On' only strengthens the identity verification of the user making the activation request; it validates that the caller is who they claim to be. It does not introduce a second party who reviews and consents to the elevation. Since no other individual or group must sign off, the role can still be activated automatically after authentication, leaving no approval control at all.
- ✗
Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'
Why it's wrong here
Requiring justification and ticket information on activation forces the user to supply business context, which is valuable for auditing, but these are merely mandatory text fields during the request. Once the user enters a reason and ticket number, PIM does not route the request to any other person for authorization—it proceeds with activation according to the role's settings. Thus these options collect data but create no approver workflow.
- ✗
Create a separate PIM request workflow using Azure Logic Apps
Why it's wrong here
While you could architect a custom approval pipeline with Azure Logic Apps that reacts to PIM audit events and triggers external sign-offs, this is not a native PIM configuration and would introduce significant custom code and identity handling complexity. PIM has a built-in approval feature that is the intended, supported path, and using Logic Apps instead ignores the actual product capability. Custom workflows also risk inconsistencies with PIM's role activation state, whereas the native approval integrates directly with the role lifecycle.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.