PIM approvals, audit history and emergency access accounts
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
Contoso made every Global Administrator and Privileged Role Administrator assignment eligible-only in PIM, and turned on Require approval to activate for both roles without naming approvers. No other account holds either role. What's the consequence?
ARequests are routed to the tenant's Security Administrators, who act as fallback approvers
BRequests go to the requester's manager for approval
CRequests are approved automatically after the approval timeout
DNobody can approve activations, so the tenant can be locked out of both roles
Show the answer and why
ARequests are routed to the tenant's Security Administrators, who act as fallback approvers
Incorrect
With no named approvers, the defaults are active Privileged Role Administrators and Global Administrators; Security Administrators aren't among them.
BRequests go to the requester's manager for approval
Incorrect
PIM role approvals don't use managers by default.
CRequests are approved automatically after the approval timeout
Incorrect
Pending requests expire; they aren't approved automatically.
DNobody can approve activations, so the tenant can be locked out of both roles
Correct
Default approvers are active Privileged Role Administrators and Global Administrators, and none are active.
When approval is required and no specific approvers are selected, active Privileged Role Administrators and Global Administrators become the default approvers. If all of them are only eligible, no one can approve and the tenant is locked out of both roles. Naming specific approvers in the role settings prevents this.
Developers must be able to become Contributor on the Prod subscription for up to four hours when needed, with each activation approved by the platform lead. They must hold no standing access to the subscription. What should you configure?
AAn eligible Contributor assignment in PIM at the Prod subscription scope, with a 4-hour maximum activation and approval
BAn eligible assignment of the Application Administrator Microsoft Entra role in PIM
CAn access package that grants Contributor on the subscription for four hours
DA permanent Contributor assignment in Azure RBAC, with a Conditional Access policy requiring MFA for the Azure portal
Show the answer and why
AAn eligible Contributor assignment in PIM at the Prod subscription scope, with a 4-hour maximum activation and approval
Correct
PIM for Azure resource roles provides time-bound activation with approval at that scope.
BAn eligible assignment of the Application Administrator Microsoft Entra role in PIM
Incorrect
Microsoft Entra roles don't grant access to Azure resources.
CAn access package that grants Contributor on the subscription for four hours
Incorrect
Just-in-time activation of an Azure role at a subscription scope, with a maximum duration and approval, comes from PIM, not from an access package.
DA permanent Contributor assignment in Azure RBAC, with a Conditional Access policy requiring MFA for the Azure portal
Incorrect
The assignment would be standing access, which the requirement rules out.
PIM manages Azure resource roles, such as Contributor on a subscription, with eligible assignments, maximum activation durations and approval, so developers hold no standing access and activate only when needed.
Auditors ask for every activation of the Exchange Administrator role through PIM over the past 12 months. The PIM Resource audit page shows only the last 30 days. What should Contoso do so it can answer such requests in future?
ARoute Microsoft Entra audit logs to Log Analytics or a storage account through a diagnostic setting
BTurn on extended retention in the PIM role settings for Exchange Administrator
CEnable My audit for each Exchange administrator
DBuy Microsoft Entra ID P2 licenses to extend audit retention to a year
Show the answer and why
ARoute Microsoft Entra audit logs to Log Analytics or a storage account through a diagnostic setting
Correct
PIM's audit is a subset of the Microsoft Entra audit logs, which diagnostic settings can retain for longer.
BTurn on extended retention in the PIM role settings for Exchange Administrator
Incorrect
PIM role settings have no audit retention option.
CEnable My audit for each Exchange administrator
Incorrect
My audit shows a user's own activity with the same 30-day window.
DBuy Microsoft Entra ID P2 licenses to extend audit retention to a year
Incorrect
No Microsoft Entra ID license keeps a year of audit history in the admin center; the logs have to be retained somewhere else.
PIM resource audit data is available for the past 30 days and is a subset of the Microsoft Entra audit logs. To keep it longer, route the audit logs through diagnostic settings to Log Analytics or an Azure storage account.
Contoso has two emergency access accounts that are excluded from its Conditional Access policies. The security team must be alerted within minutes whenever either account signs in, and must keep the alert history in Azure. Which two should you set up? (Choose TWO.)
AA diagnostic setting that sends the sign-in logs to a Log Analytics workspace
BA PIM security alert for the Global Administrator role
CA daily export of the sign-in logs to CSV, reviewed by the team
DAn ID Protection sign-in risk policy that targets the two accounts
EAn Azure Monitor alert rule on a SigninLogs query for the two accounts, with an action group
Show the answer and why
AA diagnostic setting that sends the sign-in logs to a Log Analytics workspace
Correct
The alert rule queries the sign-in logs, so they must be in a workspace.
BA PIM security alert for the Global Administrator role
Incorrect
PIM alerts flag assignment patterns such as roles assigned outside PIM, not sign-ins.
CA daily export of the sign-in logs to CSV, reviewed by the team
Incorrect
A daily export isn't an alert within minutes.
DAn ID Protection sign-in risk policy that targets the two accounts
Incorrect
Risk policies act on risky sign-ins only, and these accounts must sign in without being blocked.
EAn Azure Monitor alert rule on a SigninLogs query for the two accounts, with an action group
Correct
A log search alert fires and notifies the team when the query finds a sign-in by either account.
Microsoft's guidance for emergency access accounts is to monitor their sign-ins: send sign-in logs to a Log Analytics workspace and create an Azure Monitor alert rule whose query looks for sign-ins by the accounts' object IDs or UPNs, with an action group that notifies the team.
In Privileged Identity Management, how does an eligible assignment differ from an active assignment?
AEligible users must activate the role before using it; active users have it already
BEligible assignments never expire, while active assignments always have an end date
CEligible assignments apply only to Azure roles
DActive assignments need approval for every use
Show the answer and why
AEligible users must activate the role before using it; active users have it already
Correct
Eligibility is the basis of just-in-time access.
BEligible assignments never expire, while active assignments always have an end date
Incorrect
Both types can be permanent or time-bound.
CEligible assignments apply only to Azure roles
Incorrect
Microsoft Entra roles and groups can be eligible too.
DActive assignments need approval for every use
Incorrect
Approval applies to activating eligible assignments.
In PIM, an eligible assignment requires the user to activate the role, which can need MFA, justification or approval, before using it. An active assignment gives the role without activation. Either can be permanent or time-bound.
A user's time-bound role assignment in PIM is about to expire. When does PIM send expiry notifications?
AOnly on the day it expires
B30 days and 7 days before
CWithin 14 days of expiry, one day before, and when it expires
DPIM doesn't send notifications; users must check My roles in the portal
Show the answer and why
AOnly on the day it expires
Incorrect
Notifications start earlier.
B30 days and 7 days before
Incorrect
PIM uses 14 days and one day.
CWithin 14 days of expiry, one day before, and when it expires
Correct
PIM notifies admins and the user at those points.
DPIM doesn't send notifications; users must check My roles in the portal
Incorrect
PIM sends email notifications about expiring assignments.
PIM emails administrators and the affected user or group about roles expiring within 14 days and one day before expiration, and again when the assignment expires.
Which roles can't be managed with Privileged Identity Management?
ACustom Azure roles assigned at a resource group
BExchange Administrator and SharePoint Administrator in Microsoft Entra ID
CCustom Microsoft Entra roles
DThe classic subscription administrator roles, such as Co-Administrator
Show the answer and why
ACustom Azure roles assigned at a resource group
Incorrect
PIM manages built-in and custom Azure roles.
BExchange Administrator and SharePoint Administrator in Microsoft Entra ID
Incorrect
PIM supports these Microsoft Entra roles.
CCustom Microsoft Entra roles
Incorrect
PIM covers all Microsoft Entra roles.
DThe classic subscription administrator roles, such as Co-Administrator
Correct
Account Administrator, Service Administrator and Co-Administrator can't be managed in PIM.
PIM manages just-in-time assignments for all Microsoft Entra roles and all built-in and custom Azure roles. It can't manage the classic subscription administrator roles, and it doesn't support roles inside Exchange RBAC or SharePoint RBAC.
Contoso is turning on PIM for Microsoft Entra roles. Twelve administrators will get eligible assignments, two security leads will approve their activations, and the other 300 users hold no roles. For which users does Contoso need Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses?
AOnly the 12 eligible administrators
BThe 12 eligible administrators and the 2 approvers
COnly the 2 approvers who act on activation requests
DAll 314 users in the tenant, including those with no roles
Show the answer and why
AOnly the 12 eligible administrators
Incorrect
Users who approve or reject activation requests need a license too.
BThe 12 eligible administrators and the 2 approvers
Correct
Users with eligible assignments and users who can approve or reject activation requests both need one of these licenses.
COnly the 2 approvers who act on activation requests
Incorrect
The users with eligible assignments need a license as well.
DAll 314 users in the tenant, including those with no roles
Incorrect
The license is needed for the users who use PIM's features, not for users who hold no managed role.
PIM needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses for users with eligible or time-bound assignments to Microsoft Entra or Azure roles, eligible members or owners of PIM for Groups, users who can approve or reject activation requests, and users assigned to or performing access reviews.