AZ-500 Manage identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Step 1: Enable PIM, Step 2: Select roles, Step 3: Configure settings, Step 4: Assign users as eligible

  Why this is correct

  Enabling PIM first is mandatory because PIM is an Azure AD service that must be activated before any role management can occur; selecting roles next determines which directory roles will be governed by just-in-time access, then configuring settings defines activation requirements such as MFA, approval, and duration, and finally assigning users as eligible grants them the ability to activate those roles on demand. This order respects the dependency that service activation precedes role selection, which precedes role-specific configuration, which precedes user assignment.

• ✗

  Step 1: Select roles, Step 2: Configure settings, Step 3: Enable PIM, Step 4: Assign users as eligible

  Why it's wrong here

  Attempting to select roles before enabling PIM is impossible because the PIM blade and its role management interface are provisioned only after you activate PIM in Azure AD; configuring settings even later in this sequence is premature because those role-specific settings cannot exist until roles are actually chosen. This order incorrectly assumes you can define the scope of PIM governance before the service itself is initialized, whereas PIM must be the entry point to any role selection or configuration.

• ✗

  Step 1: Assign users as eligible, Step 2: Enable PIM, Step 3: Select roles, Step 4: Configure settings

  Why it's wrong here

  Assigning users as eligible first is invalid because an eligible assignment is a PIM-specific concept that requires PIM to be enabled and at least one Azure AD role to be selected as a target, and it also depends on the role's activation settings being configured to determine how users will request activation. Without the role and service in place, there is no assignment resource for the user to hold, so this step cannot logically come first.

• ✗

  Step 1: Configure settings, Step 2: Select roles, Step 3: Enable PIM, Step 4: Assign users as eligible

  Why it's wrong here

  Starting with configuring settings is incorrect because PIM's settings are scoped to each selected role — you cannot define activation rules before you have chosen which roles will be managed — and the PIM service itself must be enabled before any settings blade is accessible. This order mistakenly treats configuration as a global prerequisite rather than a role-specific step that follows role selection and service activation.

Go deeper

Related to this question