Question
You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
Elevated access must be evaluated by another administrator before it is granted.
Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Expire active assignments after
- B. Require approval to activate Correct
- C. Require justification on activation
- D. Expire eligible assignments after
- E. Activation maximum duration Correct
Explanation
Require approval to activate makes an approver evaluate each elevation request before the role becomes active. Activation maximum duration sets how long an activation stays active before it expires, so the elevated access ends automatically after that period. Expire active assignments after limits direct active assignments, which are not elevated through activation, and Expire eligible assignments after only ends the right to request the role. Require justification on activation records a reason but does not involve another administrator.
