Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A global consulting firm uses Microsoft Entra ID and has a policy that all highly privileged roles, such as 'User Administrator' and 'Application Administrator', must be assigned as 'eligible' in PIM. However, they also need to ensure that a backup break-glass account for each of these roles is always 'permanently active' to handle emergencies, even if the PIM service is temporarily unavailable. Which assignment type in PIM should be used for these specific break-glass accounts?
- AActive (permanently assigned)
- BTime-bound eligible
- CEligible with approval
- DEligible with multi-factor authentication
Show answer & explanationAnswer & explanation
Correct answer: A. Active (permanently assigned)
For break-glass accounts that need to be available even if PIM is unavailable, the 'Active (permanently assigned)' assignment type is required. This ensures the role is always active without needing activation through the PIM service.
Why the other options are wrong
- B. Time-bound eligible assignments still require activation via PIM.
- C. Eligible assignments with approval still require PIM and an approver.
- D. Eligible assignments require activation through PIM, which might be unavailable.
PIM Active Assignment (Permanent)
An assignment type in PIM where a user is permanently assigned to a role and does not need to activate it through the PIM service. This is typically used for break-glass accounts.
- Role is always active for the assigned user.
- Bypasses PIM activation workflow (just-in-time).
- Recommended for a very limited number of emergency/break-glass accounts.
Memory trick: PIM assignments: a key for every door, some always open.