Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A company uses Microsoft Entra ID and has implemented PIM for Azure AD roles. They want to ensure that all 'User Administrator' role assignments are subject to a regular review process to confirm that assigned users still require the role. The review should occur every 90 days. Which PIM setting for the 'User Administrator' role needs to be configured to meet this requirement?
- AConfigure an access review for eligible assignments
- BRequire justification for activation
- CSet maximum activation duration to 90 days
- DEnable permanent eligible assignments
Show answer & explanationAnswer & explanation
Correct answer: A. Configure an access review for eligible assignments
To implement a regular review process for role assignments, you must configure an access review for eligible assignments within the PIM settings, specifying the review frequency (e.g., every 90 days).
Why the other options are wrong
- B. Justification is for activation, not for ongoing review of assignments.
- C. Maximum activation duration controls how long a role can be active once activated, not the review of its eligibility.
- D. Permanent eligible assignments would remove the need for regular reviews, contradicting the requirement.
PIM Access Review for Eligible Assignments
A PIM setting that mandates periodic access reviews for users who are eligible for a privileged role, ensuring that their eligibility remains appropriate.
- Helps maintain least privilege by removing unnecessary eligible assignments.
- Can be configured with specific reviewers and review frequency.
- Applies to users who 'can' activate the role, not just those who have activated it.
Memory trick: PIM governance: review assignments, keep roles lean.