AZ-104 Practice Question 41: PIM Eligible Assignment

Microsoft Azure Administrator Associate (AZ-104) · Test 5 · question 1 of 10

Identity & Governancemedium

Four platform engineers need Contributor on the production subscription, but only while they are executing an approved change, roughly two evenings a month. Security requires that the access lapse on its own, that each use be justified and MFA-challenged at the moment it is taken, and that there be an audit trail of who elevated and why.

The tenant is licensed for Microsoft Entra ID Governance. What should you configure?

Show answer and explanation

Answer:

A. Make each engineer eligible for Contributor on the subscription in Privileged Identity Management, with an activation policy that requires MFA and a justification

This is the scenario Privileged Identity Management is built for. An eligible assignment "requires a user to perform one or more actions to use the role ... they can activate the role when they need to perform privileged tasks", and activation "might include performing a multifactor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers". Activation is time-limited: "once activated, the user can use the role for a preconfigured period of time before they need to activate again", which is what makes the access lapse without anyone remembering to remove it. PIM also covers the audit requirement directly: notifications when privileged roles are activated, and downloadable audit history.

Option B leaves the access standing the other 28 days of the month. That is exactly the "excessive, unnecessary, or misused access permissions" risk PIM exists to reduce, and a quarterly review closes the gap three months late.

Option C is home-made just-in-time access with none of the guarantees. There is no MFA challenge at elevation, no justification captured, no approval, and if the script fails the engineers stay Contributor indefinitely.

Option D changes nothing about when the access is held. A duplicate of Contributor is still a standing assignment, and a resource lock prevents deletions; it does not limit who has permissions or when.

Reference: What is Microsoft Entra Privileged Identity Management?

Practice Test 5 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.

AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.

Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.

Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.

Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.