Correct Answer: Check if Azure AD Privileged Identity Management (PIM) requires role activation before the assignment becomes active
If the Contributor role is configured as 'eligible' (not 'active') in Azure AD PIM, the user must explicitly activate the role before it takes effect, even if they are a group memb...
Correct Answer
Check if Azure AD Privileged Identity Management (PIM) requires role activation before the assignment becomes active
Why This Answer Is Correct
If the Contributor role is configured as 'eligible' (not 'active') in Azure AD PIM, the user must explicitly activate the role before it takes effect, even if they are a group member. This is the most common cause of unexpected access denials when PIM is in use. Resource locks affect write/delete operations, not read access verification.
This question evaluates your knowledge of Azure Active Directory — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Active Directory is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?
You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?
Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?
Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?