Microsoft Certified: Identity and Access Administrator AssociateImplement access governanceMedium
A global company uses Microsoft Entra ID and has implemented Privileged Identity Management (PIM) for its Azure AD roles. They want to ensure that 'Global Administrator' role assignments are always 'eligible' and that these assignments are permanent, meaning they do not expire unless explicitly removed or an access review revokes them. Which PIM setting should be configured for the assignment duration of the Global Administrator role?
- ASet eligible assignment to expire on a specific date
- BSet eligible assignment to require an access review annually
- CSet eligible assignment as permanently eligible
- DSet eligible assignment to expire after a specific number of days
Show answer & explanationAnswer & explanation
Correct answer: C. Set eligible assignment as permanently eligible
To ensure eligible assignments do not expire unless explicitly removed or revoked by an access review, the 'Set eligible assignment as permanently eligible' option should be selected. This grants indefinite eligibility until an administrative action or review changes it.
Why the other options are wrong
- A. This option also sets an expiration, contradicting the requirement for permanent eligibility.
- B. Requiring an access review annually ensures periodic re-validation but doesn't make the assignment 'permanently eligible' in the sense of not having an automatic expiration date.
- D. This option sets an expiration, which contradicts the requirement for permanent eligibility.
PIM Permanent Eligible Assignment
A PIM setting that configures a user's eligibility for a privileged role to be indefinite, meaning it does not have an automatic expiration date and remains active until manually removed or revoked by an access review.
- No automatic expiration for eligibility.
- Requires manual removal or access review revocation.
- Typically recommended for highly critical roles with strict governance.
Memory trick: For permanent eligibility, no date should be set, so the access won't be met with regret.