Privileged Identity Management (PIM) Flashcards

In Azure AD Privileged Identity Management, what is the difference between an 'eligible' assignment and an 'active' assignment?

Answer: Eligible users must activate their role before using it; active users have the role immediately without activation

Eligible assignments require users to go through an activation process (with optional MFA and approval) before the role becomes active, whereas active assignments grant the role immediately.

What is the default maximum activation duration for a PIM role assignment?

Answer: 8 hours

PIM's default maximum activation duration is 8 hours, though administrators can configure this value between 1 and 24 hours per role.

Which PIM feature requires a second administrator to approve a role activation request before the role becomes active?

Answer: Require approval to activate

The 'Require approval to activate' setting in PIM role settings mandates that a designated approver reviews and approves the activation request before the role is granted.

You want to ensure that all eligible Global Administrator role activations are recorded with a business justification. Which PIM role setting should you enable?

Answer: Require justification on activation

Enabling 'Require justification on activation' forces users to enter a reason before their role activation is processed.

In PIM, which role is required to manage role assignments for Azure AD directory roles?

Answer: Global Administrator or Privileged Role Administrator

The Global Administrator and Privileged Role Administrator roles have the authority to configure PIM settings and manage directory role assignments in PIM.

Which PIM capability sends email notifications to designated reviewers when an access review for a privileged role is ready for review?

Answer: Notifications in role settings

PIM role settings include a 'Notifications' section where administrators can configure email alerts sent to reviewers, approvers, and role members for key events.