SC-300 Certification Practice Question #275

Question

You have a Microsoft Entra tenant that contains three users named User1, User2, and User3.

You need to configure just-in-time (JIT) access to admin roles by using Privileged Identity Management (PIM). The solution must meet the following requirements:

•	Ensure that User1 can use the User Administrator role without approval.
•	Ensure that User2 can use the User Administrator role once User3 has approved the role request of User2.

What should you create first?

Accepted Answer

The requirement is that **User1** can use the User Administrator role **without approval** while **User2** can use it **only after User3 approves** — two *different* approval behaviors for the *same* role. Per MS Learn, the "Require approval to activate" setting lives in **PIM role settings**, which are defined **per role**, and "all assignments for the same role follow the same role settings." Therefore you cannot make User1 eligible-no-approval and User2 eligible-with-approval by directly assigning them both to the User Administrator role. The supported way to give the same effective access with different approval policies is **PIM for Groups**: create two role-assignable security groups, assign each to the User Administrator role, and configure independent per-group PIM policies (one without approval for User1's group, one requiring User3's approval for User2's group) — and MS Learn confirms per-group role settings are independent. Hence the thing you must create **first** is the **security groups**. The official Suggested Answer is **A (role assignments)**, which contradicts this constraint; per methodology MS Learn is used as the tiebreaker and confidence is lowered. This is a genuine conflict: choose **A** if you trust the published key verbatim, but the documentation supports **C** because differential approval on one role is impossible without groups. The lone community dissent (e045cfe → C) aligns with the docs.

More SC-300 practice questions