AZ-500 Question 13
Select 2Your organization has just onboarded a new Azure subscription to Microsoft Entra (Azure AD) Privileged Identity Management (PIM). The security team mandates that for the subscription-level Owner role, each assignment must be time-bound, require just-in-time activation, and need approval from the security lead before the role can be activated. Which two settings must you configure in Microsoft Entra PIM to meet these requirements?
- A
- Set the role assignment type to Eligible instead of Permanent.
- B
- Set the assignment duration to indefinite and disable access reviews.
- C
- Enable 'Require approval' in the role settings and specify the security lead as the approver.
- D
- Disable multi-factor authentication requirements in the activation process.
- E
- Configure the assignment to be Active, ensuring continuous access without prompting.
Show answer and explanation
Correct answers: A, C
Explanation
In Microsoft Entra Privileged Identity Management, configuring a role as Eligible ensures that users only have privileged access when they explicitly activate the role. This activation can further be guarded with approval, MFA, and time-bound settings. Microsoft recommends using short assignment durations, implementing just-in-time (JIT) activation, and requiring an approver for high-risk roles (such as Owner), which aligns with least-privilege and zero-trust principles. For more details, refer to official PIM documentation at https://learn.microsoft.com/azure/active-directory/privileged-identity-management.
- A. Correct.
- Correct. To implement just-in-time access, you must set roles as Eligible, ensuring that the user must activate the role before use.
- B. Incorrect.
- Incorrect. Indefinite assignment goes against the requirement of time-bound access. Disabling access reviews also undermines continuous oversight of privileged roles.
- C. Correct.
- Correct. Requiring approval and specifying an approver (in this case, the security lead) is necessary to meet the approval requirement.
- D. Incorrect.
- Incorrect. Disabling MFA is not recommended for privileged roles. PIM best practice is to enforce MFA for added security.
- E. Incorrect.
- Incorrect. Making the role assignment Active permanently contradicts the just-in-time principle of requiring users to activate and request approval on demand.