SC-300 Certification Practice Question #225

Question

You have an Azure Active Directory (Azure AD) tenant that contains the objects shown in the following table.

Which objects can you add as eligible in Azure AD Privileged Identity Management (PIM) for an Azure AD role?

Accepted Answer

Eligible PIM assignments require the principal to perform an interactive activation step (just-in-time activation, often with MFA/approval). MS Learn is explicit that managed identities, service principals, and applications cannot be made eligible because they cannot perform activation — they can only receive permanent/active assignments. In the table, Identity1 is a managed identity, so it is excluded, while both User1 (member user) and Guest1 (B2B guest user) are interactive user accounts that can be made eligible. That leaves only User1 and Guest1, which is option B. The Suggested Answer, a unanimous Most Voted (7), two Highly Voted comments (17 and 8 👍), and MS Learn all converge, with no credible dissent.

More SC-300 practice questions