AZ-500 Secure identity and access Practice Question
Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?
⚠ Common exam trap
The trap here is thinking that a separate 'Approval timeout' setting exists, when in fact the 'Maximum activation duration' serves as the timeout for the approval request itself. Candidates may incorrectly look for a distinct approval timeout setting, leading them to choose options that do not exist or are misconfigured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.
In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied. This directly meets the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.
Why it's wrong here
'Just-in-time access' is not a PIM feature; PIM uses activation requests.
- ✓
Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.
Why this is correct
This ensures the manager must approve within the activation window, or the request expires.
- ✗
Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.
Why it's wrong here
Microsoft Entra ID does not have a built-in approval workflow for PIM; it is handled within PIM settings.
- ✗
Configure the role settings to require approval and set the approval timeout to 0 minutes.
Why it's wrong here
A timeout of 0 minutes is not allowed; the minimum is 1 minute.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.