AZ-500 Secure identity and access Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure password expiration policies to force frequent changes

  Why it's wrong here

  Password expiration policies are a legacy credential-lifecycle control, not a zero-trust control. Zero trust centers on continuously verifying identity, device health, and context for every request; forcing frequent password changes fails to do that and actually encourages predictable, weak password patterns. Microsoft's security guidance aligns with NIST recommendations that periodic forced expirations be abandoned in favor of modern, risk-based authentication such as MFA and Conditional Access. The only time a password change matters in zero trust is when compromise is detected, which is a reactive, not proactive, control.

• ✗

  Enable password hash synchronization to Microsoft Entra ID

  Why it's wrong here

  Password hash synchronization (PHS) simply synchronizes on-premises Active Directory password hashes to Microsoft Entra ID so that sign-ins can be authenticated against the same credential in the cloud. PHS is an identity-connectivity feature that enables hybrid users to access cloud resources, but it does not itself enforce zero-trust principles like verify explicitly or use least privilege. Zero trust requires authentication to be challenged based on real-time signals—user, device, location, and risk—whereas PHS merely makes the same static credential available for authentication without any policy enforcement.

• ✓

  Configure Privileged Identity Management to require approval for role activation

  Why this is correct

  Configuring Privileged Identity Management (PIM) to require approval for role activation enforces just-in-time (JIT) access, a core zero-trust tenet. With PIM, a role is eligible but not active; the user must request activation for a specific time window, and an approver must grant it, which limits standing privileges and reduces the attack surface. This also provides auditing and time-bound access, ensuring that privileged roles are never permanently available and that every activation is specifically authorized. This aligns with 'use least privilege access' and 'verify explicitly' because the approval step adds an explicit verification of requestor legitimacy.

• ✗

  Assign permanent Global Administrator roles to IT staff

  Why it's wrong here

  Assigning permanent Global Administrator roles to IT staff violates the zero-trust principle of least privilege and 'assume breach.' Permanent roles grant standing, unrestricted access to all Microsoft Entra ID and tenant-wide resources; if a Global Administrator account is compromised, the attacker inherits that persistent, high-privilege access without any additional verification. Zero trust demands that access be explicitly verified and time-bound, not statically assigned. Instead, administrators should use PIM to activate elevated roles only when needed, with approval and just-in-time limits.

• ✓

  Implement Conditional Access policies that require MFA and device compliance

  Why this is correct

  Conditional Access policies that require MFA and device compliance are a direct implementation of zero trust's 'verify explicitly' principle because they evaluate real-time signals at authentication time. MFA proves user identity, while device compliance (via Intune MDM or Windows health attestation) confirms that the device is trusted and meets security baselines before access is granted. These policies can also incorporate risk, location, and session context, enabling continuous policy enforcement even after initial access. This is a primary Microsoft Entra ID control for enforcing identity and device trust under the zero-trust model.

Go deeper

Related to this question