AZ-500 Question 14
Select 2You are a Security Administrator at Contoso and need to configure Microsoft Entra Privileged Identity Management (PIM) for the Contributor role on a production Azure subscription. The security policy states that: 1) the Contributor role should be assigned as eligible and require explicit activation; 2) anyone activating the role must request approval; 3) administrators should be automatically notified when the role is activated. Which two actions should you take in the PIM settings to meet these requirements?
- A
Configure the assignment as eligible and enable the setting 'Require approval to activate' under Role Settings in PIM.
- B
Assign the role as active with no approval required, then rely on Azure Monitor alerts for notifications.
- C
Set up notifications under Role Settings in PIM to email administrators upon activation.
- D
Configure a permanent active assignment and use Azure Policy to enforce assignment duration limits.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the organization's security requirements, the PIM role settings must be configured so that the role is assigned as eligible, requires explicit activation with approval, and sends notifications upon activation. This involves adjusting the PIM Role Settings to enforce approval and email notifications. Refer to Microsoft Docs (https://learn.microsoft.com/azure/active-directory/privileged-identity-management) for detailed guidance on configuring Microsoft Entra PIM for Azure resource roles.
- A. Correct.
Correct: You must configure the Contributor role as eligible in PIM and enable the 'Require approval to activate' option so that users must request and receive approval before role activation.
- B. Incorrect.
Incorrect: Assigning the role as active without requiring approval goes against the requirement for an approval process. Azure Monitor alerts do not replace the native approval workflow in PIM.
- C. Correct.
Correct: Under the Role Settings in PIM, you can configure notifications to be sent to specified administrators via email whenever someone activates their eligible role.
- D. Incorrect.
Incorrect: A permanent active assignment does not meet the requirement for requiring explicit activation and approval. Azure Policy cannot set assignment duration for role activations in PIM; that is managed within PIM's role settings.