Configuring PIM Role Activation with Approval and Justification
Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage administrative roles. You need to ensure that when a user activates the Global Administrator role, they must provide a justification and the activation is time-bound. Additionally, you want to require approval from the security team for this activation. What should you configure?
Quick Answer
The correct answer is to modify the PIM role settings for the Global Administrator role to require justification, set a maximum activation duration, and require approval. This is correct because Privileged Identity Management (PIM) role settings are the centralized configuration point where you enforce activation requirements like justification text, time-bound limits, and designated approvers—all of which directly address the need for PIM role activation approval justification. On the MS-102 exam, this scenario tests your understanding that PIM role settings are role-specific, not global policies, and a common trap is confusing Azure AD Conditional Access policies with PIM activation controls. Remember that justification and approval are always configured inside the role’s settings blade, not in the Entra ID roles and administrators list. A helpful memory tip is “J.A.M.”—Justification, Approval, Maximum duration—the three core settings you must toggle for a compliant activation workflow.
⚠ Common exam trap
It's easy for candidates to confuse Conditional Access policies (which control authentication) with PIM role settings (which control role activation), leading them to select Option C even though Conditional Access cannot enforce approval workflows or activation duration limits.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval
Privileged Identity Management (PIM) role settings allow you to enforce activation requirements such as justification, maximum activation duration, and approval. These settings are configured directly in the PIM role settings for the Global Administrator role, ensuring that every activation request is justified, time-bound, and requires approval from designated approvers (e.g., the security team).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an Identity Protection user risk policy for Global Administrators
Why it's wrong here
Identity Protection does not control PIM activation.
- ✗
Create an Access Review for Global Administrator role
Why it's wrong here
Access Reviews are for recertification, not activation.
- ✗
Configure a Conditional Access policy requiring MFA for Global Administrator activation
Why it's wrong here
Conditional Access policies apply after activation, not during.
- ✓
Modify the PIM role settings for Global Administrator to require justification, set maximum activation duration, and require approval
Why this is correct
PIM settings allow these configurations.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every MS-102 question from scratch — 241 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID. You are implementing Privileged Identity Management (PIM) to manage access to Azure AD roles. You need to ensure that when a user activates a privileged role, the activation request must be approved by their manager and must include a ticket number. What should you configure?
hard- A.Create an access review for the role
- ✓ B.Modify the role settings in PIM to require approval and justification with ticket number
- C.Configure an access package in Entitlement Management
- D.Use Conditional Access policy with session controls
Why B: PIM role settings allow you to configure activation requirements, including requiring approval and mandating a justification field. By enabling 'Require approval to activate' and configuring the approver as the user's manager, and by setting 'Require ticket information on activation', you enforce that every activation request includes a ticket number and is routed to the manager for approval.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.