mediumMultiple Choice
MS-102 Practice Question: An administrator who is not a Global…
An administrator who is not a Global Administrator needs to manage just-in-time privileged access to Azure resources using Microsoft Entra Privileged Identity Management (PIM). Which built-in role must be assigned to the administrator to allow PIM management for Azure resources?
⚠ Common exam trap
Test-takers frequently confuse the Privileged Role Administrator role with the Global Administrator role, assuming only Global Admins can manage PIM, but Microsoft specifically designed the Privileged Role Administrator to delegate PIM management without granting full tenant-wide administrative control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Role Administrator
The Privileged Role Administrator role is the only built-in role that grants permissions to manage all aspects of Privileged Identity Management (PIM) for Azure resources, including configuring just-in-time access, managing role assignments, and approving activation requests. This role is specifically designed for administrators who need to oversee PIM without requiring Global Administrator privileges, as it provides full control over PIM policies and role settings across Microsoft Entra ID and Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Privileged Role Administrator
Why this is correct
Privileged Role Administrator is the correct choice because this role is explicitly delegated to manage just-in-time access and governance in Microsoft Entra PIM. It can configure PIM settings for both Microsoft Entra roles and Azure resources, approve activation requests, and create eligible or active assignments for other roles. This is the least-privileged built-in role that can perform these tasks without requiring Global Administrator.
- ✗
User Administrator
Why it's wrong here
User Administrator is incorrect because their administrative scope is limited to managing users and groups, such as resetting passwords, assigning licenses, and updating user profile properties. They have no built-in permissions over Microsoft Entra Privileged Identity Management, so they cannot configure activation policies, approve requests, or modify role assignments for Azure resources. PIM governance requires roles with the Microsoft.Authorization/roleAssignments/write permission and Privileged Identity Management delegated actions, which User Administrator lacks.
- ✗
Security Administrator
Why it's wrong here
Security Administrator is incorrect because although they can read security-related reports, view alerts, and manage security policies, they cannot manage Privileged Identity Management itself. They cannot update PIM settings, approve role activations, or manage role assignments because those actions require write access to PIM and Azure role assignment data, not just security policy configuration. Security Administrator is designed for monitoring and responding to threats, not for governing privileged identity lifecycle.
- ✗
Application Administrator
Why it's wrong here
Application Administrator is incorrect because their administrative scope is restricted to enterprise applications, application registrations, and related application consent policies. They have no built-in permissions to manage Microsoft Entra Privileged Identity Management or Azure role assignments, so they cannot approve activations or configure PIM governance for Azure resources. Application management and identity governance are distinct administrative planes, and PIM requires a role that is specifically delegated privileged role management.
Go deeper
Related to this question
Learn chapter
Entra ID Governance Portal
Key term
Privileged access
Privileged access is a special level of permission that allows a user or system to perform high-impact actions like installing software, changing system settings, or accessing sensitive data across an IT environment.
Key term
Just-in-time access
Just-in-time access is a security method that grants users elevated permissions only for a limited time exactly when they need them, then automatically removes those permissions.
About these practice questions
Courseiva writes every MS-102 question from scratch — 712 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.