The correct answer is to assign the user as 'Eligible' for the role. In Azure AD Privileged Identity Management (PIM), an eligible assignment means the user has no permanent or standing access; they must activate the role on-demand through a time-bound process that can require approval and multi-factor authentication. This directly satisfies the requirement of avoiding standing access because the role remains inactive until the user explicitly activates it via the PIM activation workflow. On the AZ-500 exam, this concept tests your understanding of just-in-time access as a core principle of identity security—a common trap is confusing 'Eligible' with 'Active,' where an active assignment grants permanent, standing access. Remember the memory tip: "Eligible means you can, but you don't have it yet; Active means you always have it." This distinction is critical for implementing least-privilege and meeting the search intent for eligible assignment PIM just-in-time access scenarios.
AZ-500 Manage identity and access Practice Question
This AZ-500 practice question tests your understanding of manage identity and access. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: eligible assignments require users to activate roles.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Azure AD Privileged Identity Management (PIM) to manage access to the 'Security Administrator' role. They want a specific user to be able to activate the role only when needed, rather than having standing access. The user should not have the role active at all times. Which type of assignment should they configure for this user in PIM?
Why wrong: An active assignment gives the user permanent standing access to the role, which does not meet the requirement of activating only when needed.
B
Assign the user as 'Eligible' for the role.
An eligible assignment requires the user to activate the role for a specified duration. This provides just-in-time access without permanent privileges.
C
Assign the user as 'Permanent' for the role.
Why wrong: In PIM, 'permanent' is not a distinct assignment type; it is synonymous with 'active'. It does not provide the required activation process.
D
Add the user as a 'Guest' in the directory.
Why wrong: Guest users are external users invited to the directory. This does not relate to PIM role assignments.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the user as 'Eligible' for the role.
In Azure AD Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.
Key principle: Eligible assignments require users to activate roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Assign the user as 'Active' for the role.
Why it's wrong here
An active assignment gives the user permanent standing access to the role, which does not meet the requirement of activating only when needed.
✓
Assign the user as 'Eligible' for the role.
Why this is correct
An eligible assignment requires the user to activate the role for a specified duration. This provides just-in-time access without permanent privileges.
Related concept
Eligible assignments require users to activate roles.
✗
Assign the user as 'Permanent' for the role.
Why it's wrong here
In PIM, 'permanent' is not a distinct assignment type; it is synonymous with 'active'. It does not provide the required activation process.
✗
Add the user as a 'Guest' in the directory.
Why it's wrong here
Guest users are external users invited to the directory. This does not relate to PIM role assignments.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is confusing 'Active' (permanent standing access) with 'Eligible' (just-in-time activation), as candidates often think 'Active' means the user can activate the role, when in fact it means the role is always active.
Detailed technical explanation
How to think about this question
Under the hood, an 'Eligible' assignment in PIM creates a role assignment in the Azure AD role definition with a status of 'Not active'. When the user activates the role, PIM creates a temporary activation record with a configurable duration (default 1 hour, max 8 hours) and optionally requires approval from designated approvers. The activation process also enforces Azure AD Multi-Factor Authentication and can require a business justification, ensuring just-in-time access with audit trail.
KKey Concepts to Remember
Eligible assignments require users to activate roles.
Activation provides just-in-time access for a limited duration.
PIM eligible assignments reduce the attack surface of standing privileges.
Active assignments grant permanent, standing access to a role.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Eligible assignments require users to activate roles.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-500 question in full detail.
Manage identity and access — This question tests Manage identity and access — Eligible assignments require users to activate roles..
What is the correct answer to this question?
The correct answer is: Assign the user as 'Eligible' for the role. — In Azure AD Privileged Identity Management (PIM), an 'Eligible' assignment means the user does not have permanent access to the role. They must activate the role on-demand through a time-bound activation process, which may require approval and multi-factor authentication. This directly meets the requirement of having no standing access, as the role is inactive until the user explicitly activates it.
What should I do if I get this AZ-500 question wrong?
Review eligible assignments require users to activate roles., then practise related AZ-500 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Eligible assignments require users to activate roles.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.