AZ-500 Manage identity and access Practice Question
You are configuring Microsoft Entra Privileged Identity Management (PIM) for a group of users who need to activate the Security Administrator role. The role should only be activated after approval by a designated approver, and the activation should be limited to a maximum of 4 hours. Which two settings must you configure in the role's PIM settings? (Choose two.)
⚠ Common exam trap
The trap here is assuming that MFA or justification are required when the scenario only specifies approval and a time limit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require approval to activate.
To enforce approval and a maximum activation duration, you must enable 'Require approval to activate' and set the 'Maximum activation duration' to 4 hours. These two settings directly address the requirements. Other settings like justification or MFA are optional and do not fulfill the specified conditions. Proper configuration ensures that privileged access is tightly controlled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require approval to activate.
Why this is correct
The 'Require approval to activate' setting enforces that a designated approver must approve the activation request before the role becomes active. This matches the requirement that activation should only occur after approval by a designated approver. Without this setting, users could activate the role without any oversight, violating the scenario's conditions.
- ✗
Require conditional access authentication context.
Why it's wrong here
Authentication context allows you to enforce specific Conditional Access policies during activation, but it is an advanced feature and not necessary to meet the basic requirements of approval and duration. The scenario does not mention any conditional access requirements. Thus, it is not one of the two settings that must be configured.
- ✗
Require multi-factor authentication on activation.
Why it's wrong here
Requiring MFA on activation is a security best practice and is often recommended, but it is not explicitly required by the scenario. The scenario focuses on approval and time limit. While MFA adds security, it does not satisfy the need for an approver or the 4-hour limit. Therefore, it is not one of the two required settings.
- ✗
Require justification on activation.
Why it's wrong here
Requiring justification is a good practice but is not mandatory to meet the stated requirements. The scenario specifically requires approval and a time limit. Justification adds an extra layer but is not one of the two required settings. It can be enabled optionally, but it does not fulfill the approval or duration requirements.
- ✓
Set the maximum activation duration to 4 hours.
Why this is correct
The maximum activation duration setting controls how long a user can keep the role active after activation. Setting it to 4 hours ensures that the role is automatically deactivated after that period. This directly meets the requirement of limiting activation to a maximum of 4 hours. It is a core setting in PIM role configuration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 617 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.