Microsoft Entra PIM Role Activation Requirements
Short answer
User 1 cannot activate the role (No) because MFA is disabled, User 2 can use the role (Yes) because they have an active assignment, and User 3 cannot activate the role (No) because they are outside the assignment date range.
Question
HOTSPOT
You have a Microsoft Entra tenant that contains the users shown in the following table.
In Microsoft Entra Privileged Identity Management, the Role settings for the Contributor role are configured as shown in the exhibit.
You assign users the Contributor role on May 1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Key Takeaways
PIM role settings requiring MFA on active assignment apply only to users activating an eligible assignment, not to those who already have an active assignment.
This scenario evaluates the conditions for role activation in Microsoft Entra Privileged Identity Management (PIM), focusing on MFA requirements and time-bound assignments. It establishes that users with eligible assignments must satisfy MFA requirements, while those with active assignments bypass activation requirements entirely.
Common mistake: Assuming that the PIM MFA requirement applies to users who already have an active assignment, or overlooking that a user with MFA disabled cannot complete an eligible role activation that requires MFA.
Expert Analysis
Why the Answer Is Correct
User 1 cannot activate the Contributor role because the PIM role settings require MFA on activation, and User 1 has MFA disabled on their account. User 2 can use the role because they have a permanent Active assignment, which bypasses the activation process and its associated MFA requirement. User 3 cannot activate the role because their eligible assignment window has expired, making them outside the allowed time range for activation.Why Other Candidate Answers Are Wrong
Some might think User 2 is blocked due to having MFA disabled, but PIM only enforces MFA at the time of activation for eligible assignments, not for users who are already assigned as Active. Others might believe User 1 can activate since they have the eligible role, but PIM strictly blocks activation if the MFA requirement cannot be met. Assuming User 3 can activate ignores the time-bound constraints of the eligible assignment that has lapsed.Community Comment Notes
As Craigg noted, "User 1 is no as MFA is Disabled" because the activation requirement cannot be fulfilled. Craigg also pointed out that "User 2 is yes as they have active assignment so MFA being disable is not a factor", confirming active assignments bypass activation constraints. Finally, "User 3 is no outside date" reflects the expiration of the time-bound eligible assignment.Official Reference
Exam Strategy
When analyzing PIM scenarios, clearly distinguish between Active and Eligible assignments; Active assignments do not require activation and thus bypass activation-time requirements like MFA. Always check if the user's MFA state or assignment expiration prevents them from satisfying the role settings.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 1
-
Craigg 👍 1User 1 is no as MFA is Disabled. User 2 is yes as they have active assignment so MFA being disable is not a factor. User 3 is no outside date
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →