PIM Role Activation Approval and Audit Logging
Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?
Quick Answer
The answer is to configure PIM role settings to require approval and enable audit logging. This directly satisfies both compliance requirements because requiring approval ensures a manager authorizes each privileged role activation, while enabling audit logging retains activation history in the Microsoft Entra audit log for at least one year, meeting the audit trail mandate. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how PIM’s role settings bundle approval workflows and logging as separate toggles—a common trap is assuming default logging is sufficient, but you must explicitly enable it for long-term retention. The key is remembering that PIM approval and audit logging are independent controls; you need both to satisfy compliance. Memory tip: “Approve and Log” to cover both the gate and the paper trail.
⚠ Common exam trap
A common mix-up: candidates confuse access reviews (periodic recertification) with the real-time approval workflow required for each activation, or they assume MFA alone satisfies the audit and approval requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set PIM role settings to require approval and enable audit logging
It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure access reviews for privileged roles
Why it's wrong here
Access reviews are periodic, not real-time activation approval.
- ✓
Set PIM role settings to require approval and enable audit logging
Why this is correct
PIM supports approval workflow and logs are retained for auditing.
- ✗
Enable Conditional Access policies for privileged roles
Why it's wrong here
Conditional Access controls access but doesn't provide approval workflow.
- ✗
Require Azure MFA for role activation
Why it's wrong here
MFA is a security control but not an approval process.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?
medium- A.Microsoft Purview Data Loss Prevention
- ✓ B.Conditional Access policies requiring MFA for privileged roles
- C.Microsoft Defender for Cloud security score
- D.Microsoft Defender Vulnerability Management
- ✓ E.Microsoft Entra Privileged Identity Management (PIM)
Why B: Option B is correct because Conditional Access policies that require multifactor authentication for privileged directory roles (such as Global Administrator) enforce strong authentication at sign-in, directly reducing the risk of credential compromise for high-impact accounts. Option E is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time role activation, approval workflows, time-bound assignments, and access reviews, which minimize standing privileged access and its exposure window. Together, B and E address both authentication strength and the elimination of permanent admin rights, which are core controls for protecting privileged accounts in Entra ID. Option A (Microsoft Purview Data Loss Prevention) is incorrect because it protects sensitive data in motion/at rest rather than securing privileged identities. Option C (Microsoft Defender for Cloud security score) is incorrect because it is a posture assessment metric, not an access control for privileged accounts. Option D (Microsoft Defender Vulnerability Management) is incorrect because it identifies and remediates software vulnerabilities, not privileged identity protection.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.