SC-300 Certification Practice Question #273

Question

You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant contains the groups shown in the following table.

Which groups can you manage by using Privileged Identity Management (PIM)?

Accepted Answer

This question is about PIM **for Groups** (the only PIM construct that "manages groups"). Per MS Learn, the eligibility rule is purely: any Microsoft Entra **security group or Microsoft 365 group**, *except* dynamic-membership groups and groups synced from on-premises. Role-assignability and the security-enabled flag are explicitly stated to be **independent** properties that do not gate PIM-for-Groups enablement. In the table all four groups have Membership type = **Assigned** (static, not dynamic) and none are on-prem synced, so all four — Group1, Group2 (Security), Group3, Group4 (Microsoft 365) — qualify, which is choice **E**. The community Most Voted/Suggested answer A (Group2 only) and the popular "Group 2 and 3" lab claims conflate PIM-for-Groups with **role-assignable** groups (the "Role assignment allowed" column), but the docs are explicit that a group does NOT need to be role-assignable to be enabled in PIM for Groups. Because the official Suggested/Most Voted answer (A) directly contradicts MS Learn, confidence is lowered and the conflict is documented: by the letter of the current documentation the answer is E; if the exam intends the older Privileged-Access-Groups behavior (role-assignable only), the intended key may differ.

More SC-300 practice questions