MS-102 Practice Question: Implement and manage Microsoft Entra identity and access
You manage a Microsoft 365 E5 tenant with Microsoft Entra ID P2. The security team wants to ensure that when a user is assigned the Global Administrator role, the assignment is time-bound, requires approval, and requires multifactor authentication for activation. You need to configure Privileged Identity Management (PIM). Which setting should you configure?
⚠ Common exam trap
Many candidates confuse active assignments with eligible assignments; only eligible assignments require activation, which can then enforce approval and MFA.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In PIM, for the Global Administrator role, set the assignment type to Eligible, configure activation settings to require approval and Azure MFA, and set the maximum activation duration.
Privileged Identity Management (PIM) enables just-in-time role activation. To meet the requirements, the Global Administrator role must be assigned as eligible, and the role settings must require approval and Azure MFA for activation, with a maximum activation duration. This ensures time-bound, approved, and MFA-protected access, which is the core purpose of PIM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In PIM, for the Global Administrator role, configure the role settings to require justification and enable alerts for role activation.
Why it's wrong here
Requiring justification and enabling alerts adds oversight but does not enforce approval, MFA, or time-bound assignments. These settings alone do not meet the requirement for approval-based, MFA-protected, time-bound activation. They are supplementary controls, not the core configuration needed.
- ✗
In Microsoft Entra ID, create a Conditional Access policy that requires MFA for users assigned the Global Administrator role.
Why it's wrong here
Conditional Access can enforce MFA for directory roles, but it does not make the role assignment time-bound or require approval for activation. The requirement includes time-bound eligibility and approval, which are PIM-specific capabilities. Conditional Access alone cannot satisfy all conditions.
- ✓
In PIM, for the Global Administrator role, set the assignment type to Eligible, configure activation settings to require approval and Azure MFA, and set the maximum activation duration.
Why this is correct
Making the Global Administrator role eligible allows users to activate it on demand. Configuring activation settings to require approval and Azure MFA ensures the activation is controlled and secure. Setting the maximum activation duration makes the assignment time-bound. This combination meets all stated requirements for time-bound, approval-based, and MFA-protected activation.
- ✗
In PIM, for the Global Administrator role, set the assignment type to Active and configure the assignment to expire after 30 days.
Why it's wrong here
An active assignment means the user has the role permanently until it expires, without needing activation. This does not require approval or MFA at activation, because there is no activation step. While it is time-bound via expiration, it fails the requirements for approval and MFA on activation.
Go deeper
Related to this question
Learn chapter
Entra ID Governance Portal
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
About these practice questions
This MS-102 question is part of Courseiva's 712-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.