AZ-500 Manage identity and access Practice Question
A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that when a user activates this role, they must provide a support ticket number and a brief justification. Additionally, the activation should have a maximum duration of 4 hours. Which PIM role setting should they configure?
⚠ Common exam trap
Candidates often confuse 'Require justification on activation' with 'Require approval', mistakenly thinking that a support ticket number implies an approval workflow, but justification is a mandatory input field, not an approval step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require justification on activation
The 'Require justification on activation' setting in Azure AD PIM allows you to mandate that users provide a support ticket number and a brief justification when activating a role. This setting enforces the collection of business-specific details during activation, which aligns with the requirement. The maximum activation duration of 4 hours is configured separately via the 'Activation maximum duration' setting, not through justification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require approval
Why it's wrong here
Requiring approval in PIM means that a separate approver must review and approve the activation request before the role becomes active. This setting adds a human approval gate, but it does not force the requesting user to enter a ticket number or justification; the request can be submitted with empty or optional justification fields. Therefore, it fails the requirement to collect support ticket information.
- ✗
Require MFA
Why it's wrong here
Requiring MFA enforces an additional identity verification (such as the Microsoft Authenticator app or a phone call) when the user activates a role. While this strengthens authentication and reduces the risk of compromised accounts, it does not capture any business context like a ticket number or justification. The activation request could still be submitted without entering a ticket number unless a separate justification/ticketing setting is also enabled.
- ✓
Require justification on activation
Why this is correct
This setting, often labeled 'Require justification' in PIM role settings, makes the justification text box mandatory during role activation. When enabled, the user must type a reason (and typically a support ticket number, depending on the ticketing requirement) before the activation request is submitted, and this value is then recorded in the PIM audit log. It directly satisfies the business requirement to enforce entering a ticket number and justification; activation duration is configured separately and does not affect this enforcement.
- ✗
Require Azure AD Identity Protection
Why it's wrong here
There is no PIM role setting called 'Require Azure AD Identity Protection.' Azure AD Identity Protection is a separate service that provides risk-based signals and conditional access policies, which PIM can reference (e.g., to block a risky user) but it cannot require justification or ticket entry. Enabling any identity protection integration would only assess risk scores, not enforce that the user provides a ticket number, so this option is both unavailable and irrelevant to the stated requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.