How to Configure PIM Activation Settings for Role Justification and Duration
A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?
Quick Answer
The answer is the Activation settings within the Azure AD PIM role configuration. This is correct because the Activation settings blade specifically controls the conditions under which an eligible user can activate a role, including the mandatory justification field and the maximum activation duration in hours. By configuring these settings, you can enforce a requirement for a support ticket number in the justification and cap the activation at 4 hours, directly addressing the need for both justification and duration control. On the AZ-500 exam, this question tests your understanding of the distinction between Activation settings, which govern the activation process itself, and other settings like Assignment or Notification settings, which handle different lifecycle aspects. A common trap is confusing Activation settings with Role settings or Eligibility settings, but remember that any requirement tied to the moment of activation—such as justification, approval, or time limits—lives exclusively under Activation. Memory tip: “Activation is the gatekeeper” — if it happens when the user clicks “Activate,” it’s an Activation setting.
⚠ Common exam trap
Many exam-takers confuse 'Assignment settings' (which control the duration of an eligible or active assignment) with 'Activation settings' (which control the duration and conditions of activation for eligible users), leading them to incorrectly select Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activation settings
The 'Activation settings' in Azure AD PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Activation settings
Why this is correct
In the activation settings for the role, you can set maximum duration (4 hours) and require justification with a ticket number field.
- ✗
Notification settings
Why it's wrong here
Notification settings control who receives emails when a role is activated or assigned, not the activation parameters.
- ✗
Approval settings
Why it's wrong here
Approval settings require approval from designated approvers. While they can require a ticket number, the maximum activation duration is set in activation settings.
- ✗
Assignment settings
Why it's wrong here
Assignment settings define the start and end dates for eligible or active assignments, not the activation behavior.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A privileged administrator should activate the Security Administrator role only for approved work and for a limited time. What should be configured?
medium- A.Permanent active assignment in Microsoft Entra ID
- ✓ B.Eligible assignment with activation controls in Privileged Identity Management
- C.Owner role at the subscription root
- D.Conditional Access session persistence
Why B: Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure eligible assignments for roles like Security Administrator. This means the user must activate the role on demand, with time-bound activation controls (e.g., maximum activation duration, approval, MFA), ensuring the role is used only for approved work and for a limited time. This directly meets the requirement of just-in-time (JIT) access and temporary activation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.