SC-300 Certification Practice Question #219

Question

Your company recently implemented Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
While you review the roles in PIM, you discover that all 15 users in the IT department at the company have permanent security administrator rights.
You need to ensure that the IT department users only have access to the Security administrator role when required.
What should you configure for the Security administrator role assignment?

Accepted Answer

The 15 IT users currently have *permanent active* Security administrator rights, meaning the role is always on. The requirement is that they "only have access ... when required" — the textbook definition of just-in-time (JIT) access. Per MS Learn, an **Eligible** assignment requires the user to perform an action (activation) to use the role, granting access only on demand. Changing the assignment type to Eligible (D) is the single configuration that converts always-on access into JIT access. Suggested Answer, Most Voted, and the two highest-signal comments all converge on D, and MS Learn confirms the concept verbatim. The lone B dissent addresses only the expiration of an active assignment, which does not by itself remove permanent access — so it is discounted. Confidence is high but not maxed because, as Eltooth notes, fully achieving the goal also requires removing the existing permanent assignment, a step outside the listed options.

More SC-300 practice questions