Exam SC-300 topic 11 question 4 discussion

Should it be AD instead of AE? To require justification need assignment to be Eligible instead of Active https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

You should be eligible to be able to activate the role with a justification

why all this discussion the answer is simple : we want to requires users to provide a reason for activating the role and a feature ensures that users must activate the role when needed(Eligible) , so AD

A/D "Configure the User administrator role to require justification and approval to activate." If you set the assignment to active, then there is no need for approval to activate.

Tech Requirement is: Users assigned the User administrator role must be able to REQUEST permission to use the role when needed for UP TO ONE year. The key words are: 1) REQUEST i.e assignment should be set to Eligible and option 'D' fulfills it. 2) Upto ONE year i.e We need to modify the 'Expire eligible assignments after' setting. First set the 'Allow permanent eligible assignment' to 'No' and then set the 'Expire eligible assignments after' to '1' year. Therefore, the correct answer is C&D.

AD, the combination of AE simply does not make sense

Why D & E confuse us: E requires justification for a person who assigns the role and NOT for the assignee. This means that this person should justify why they made this role active. On the other hand, D refers to the member with the role and privileges to perform an action. With eligible roles, we can set members to get approval before they act. The question refers to the latter case. What we need is for whoever uses the User Admin role to have approval.

"Eligible" require action to activate, which then can be set as "require approval"

A. Select require justification on activation D. Set all assignments to Eligible

A and D. The requirements "Configure the User administrator role to require justification and approval to activate" means that it must be Eligible and "Require Justification on Activation." An Active Role (option E) means no approval or justification is required, therefore, does not met the requirements.

Question says: – Configure the User administrator role to require justification and approval to activate. The type of the assignment • Eligible assignments require the member of the role to perform an action to use the role. Actions might include activation, or requesting approval from designated approvers. • Active assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure#assign

(AE )is the correct answer, when you assign PIM role, assignment type =Active allows you the type justification.

Agree AD

Activation = Eligible Active = Permanently active Justification on activation implies Eligible They also want to make approval in addition to justification a requirement to activate User Administrator, so clearly it is eligible and not active permanently

I think AD is correct. Need to be eligible

A&D - "Configure the User administrator role to require justification and approval to activate." so need to set to eligible and select require justification for activation. If it was set all assignments to active wouldn't need to require justification.

Need to set all assignments to Eligible not Active. User will need to activate PIM and enter justification.