AZ-500 Manage identity and access Practice Question
A company uses Microsoft Entra Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a ticket number as justification, and the activation must be approved by a designated approver group. The role activation duration should be limited to 4 hours. Which PIM settings should be configured?
⚠ Common exam trap
It's easy for candidates to confuse 'justification' with 'ticket information' and assume that enabling justification alone satisfies the ticket number requirement, or they may think that a ticket number inherently serves as approval, leading them to omit the approval configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.
The scenario requires both approval and ticket-based justification. In Microsoft Entra PIM, 'Require approval' enforces that a designated approver group must approve the activation, while 'Require ticket information on activation' ensures the user provides a ticket number as justification. Setting 'Activation maximum duration' to 4 hours limits the role activation time. These three settings together satisfy all requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable 'Require approval' for the role and set 'Approvers' to the designated group. Also, set 'Activation maximum duration' to 4 hours.
Why it's wrong here
Enabling 'Require approval' with the designated group as approvers correctly establishes the approval workflow, but this configuration omits the 'Require ticket information on activation' setting. In PIM, ticket information is a distinct activation requirement that must be toggled separately; without it, a user can request activation without supplying a ticket number, failing the company's compliance rule. The 4-hour maximum duration is correct, but the missing ticket-information requirement makes this option incomplete.
- ✗
Enable 'Require justification on activation' and set 'Activation maximum duration' to 4 hours. No approval configuration is needed.
Why it's wrong here
The 'Require justification on activation' setting only forces the user to type a free-form reason into the activation request; it does not enforce a ticket number or a structured ticket field. Additionally, the policy explicitly requires approval from a designated group, and this option disables or omits approval configuration entirely. Without the approval step, there is no oversight by the designated group, so this does not meet the stated requirements.
- ✓
Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.
Why this is correct
This is the correct configuration because it enables all three required policies in PIM: approval by the designated group, mandatory ticket information on activation, and a 4-hour maximum activation duration. Requiring ticket information ensures that every activation request includes a support ticket number, which satisfies the ticketing compliance requirement. The approval workflow with the designated group as approvers guarantees that a human approves each eligible activation before the role becomes active.
- ✗
Enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours. Approval is not required because the ticket number serves as justification.
Why it's wrong here
While requiring ticket information on activation captures the ticket number, PIM does not treat ticket information as a substitute for approval. The company policy requires both an approval step from a designated group and the ticket number as separate activation requirements. This option disables the approval workflow, so there is no designated approver reviewing the request, meaning the activation can proceed automatically once ticket info is provided, which violates the approval requirement.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.