Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Use Azure AD Privileged Identity Management (PIM) to configure the Global Administrator role as eligible-only with an approval workflow and notifications

Azure AD PIM allows you to configure privileged roles as 'eligible' rather than permanently 'active'. For the Global Administrator role, you can require: MFA on activation, justifi...

📋Part of Microsoft Certified: Azure Security Engineer Associate (AZ-500) · Azure Certification Practice
Real Exam ScenarioAzure Active Directory

Your organization wants to enforce that no permanent Global Administrator assignments exist in Azure AD. All Global Admin access must be time-bound, require approval, and trigger a notification. Which Azure AD feature provides these controls?

✓ Correct Answer & ExplanationAzure Active Directory

Correct Answer

Use Azure AD Privileged Identity Management (PIM) to configure the Global Administrator role as eligible-only with an approval workflow and notifications

Why This Answer Is Correct

Azure AD PIM allows you to configure privileged roles as 'eligible' rather than permanently 'active'. For the Global Administrator role, you can require: MFA on activation, justification, and approval from designated approvers. Notifications are sent to approvers and admins. This eliminates standing privileges while maintaining access when legitimately needed.

📚 What This Question Tests

This question evaluates your knowledge of Azure Active Directory — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Azure Active Directory is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Security Engineer Associate (AZ-500) Questions →Browse All Azure Exams →

More Azure Active Directory Practice Questions

A user in your Azure AD tenant is reporting they can sign in successfully but cannot access a specific Azure resource even though they are a member of a group that has the Contributor role on that resource. What should you investigate first?

Your organization requires that all Azure AD global administrator accounts use phishing-resistant MFA only. You must enforce this without creating per-user MFA settings and in a way that applies to all current and future global admins. What is the recommended approach?

You need to allow an external vendor to access a specific Azure storage account for 30 days. The vendor uses a different Azure AD tenant. You want to avoid creating guest accounts and leverage their existing corporate identity. Which solution should you use?

Azure AD Identity Protection has flagged a user account as 'High' risk due to detected leaked credentials. The user has been blocked from signing in. You investigate and confirm this was a false positive. What is the correct remediation action?

← Back to Microsoft Certified: Azure Security Engineer Associate (AZ-500) Full Practice Hub