Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
PIM Role Activation Approval and Audit Logging
Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?
Quick Answer
The answer is to configure PIM role settings to require approval and enable audit logging. This directly satisfies both compliance requirements because requiring approval ensures a manager authorizes each privileged role activation, while enabling audit logging retains activation history in the Microsoft Entra audit log for at least one year, meeting the audit trail mandate. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how PIM’s role settings bundle approval workflows and logging as separate toggles—a common trap is assuming default logging is sufficient, but you must explicitly enable it for long-term retention. The key is remembering that PIM approval and audit logging are independent controls; you need both to satisfy compliance. Memory tip: “Approve and Log” to cover both the gate and the paper trail.
⚠ Common exam trap
A common mix-up: candidates confuse access reviews (periodic recertification) with the real-time approval workflow required for each activation, or they assume MFA alone satisfies the audit and approval requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set PIM role settings to require approval and enable audit logging
It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure access reviews for privileged roles
Why it's wrong here
Access reviews are periodic, not real-time activation approval.
- ✓
Set PIM role settings to require approval and enable audit logging
Why this is correct
PIM supports approval workflow and logs are retained for auditing.
- ✗
Enable Conditional Access policies for privileged roles
Why it's wrong here
Conditional Access controls access but doesn't provide approval workflow.
- ✗
Require Azure MFA for role activation
Why it's wrong here
MFA is a security control but not an approval process.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?
medium- A.Microsoft Purview Data Loss Prevention
- ✓ B.Conditional Access policies requiring MFA for privileged roles
- C.Microsoft Defender for Cloud security score
- D.Microsoft Defender Vulnerability Management
- ✓ E.Microsoft Entra Privileged Identity Management (PIM)
Why B: Conditional Access policies can enforce multifactor authentication (MFA) specifically for users assigned to privileged roles in Microsoft Entra ID. This directly protects those accounts by requiring a second authentication factor, reducing the risk of credential theft or reuse. It is a core identity security control recommended by Microsoft for privileged access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.