AZ-500 Manage identity and access Practice Question
A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?
⚠ Common exam trap
Test-takers frequently confuse applying a Conditional Access policy to the 'Azure AD Privileged Identity Management' cloud app (which controls access to the PIM portal) with enforcing conditions during the actual role activation process, which requires authentication context integration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.
Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.
Why it's wrong here
Directly targeting the PIM app in a CA policy is not supported for device compliance during activation. PIM activation occurs in the context of the Azure AD role, not the PIM app. The correct method uses authentication context.
- ✗
In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.
Why it's wrong here
Enabling 'Require Multi-Factor Authentication on activation' only adds an MFA challenge during the PIM activation flow. MFA verifies the user's identity via a second factor (e.g., phone call or authenticator app), but it does not evaluate the device's health or compliance status. A non-compliant device can still complete MFA, so this setting fails to enforce the required device compliance condition. To require device compliance, you must use a Conditional Access policy that evaluates the device state, not just an MFA gate in PIM.
- ✓
In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.
Why this is correct
This is the correct approach because PIM supports emitting an Azure AD Conditional Access authentication context during role activation. When you enable 'Require Azure AD Conditional Access authentication context' in PIM settings, Azure AD sends that context as a signal to Conditional Access for the activation request. A separate Conditional Access policy can then target that authentication context and apply the 'Require device to be marked as compliant' grant control. This is the documented integration pattern for combining PIM with device-compliance policies, and it satisfies the requirement without relying on unsupported targets like the PIM app itself.
- ✗
Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.
Why it's wrong here
Azure AD Identity Protection's user risk policy evaluates the likelihood that a user's account has been compromised, not the compliance state of the device being used. The policy can block access or require additional measures like MFA or password change, but it has no capability to enforce a 'device must be compliant' condition. Device compliance is determined by Intune or MDM policies and must be checked by Conditional Access through a compliance grant control. Therefore, using a user risk policy would not mandate that the Global Administrator activate PIM from a compliant device; it only addresses risk, not device health.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.