Explanation:
Statement
Yes / No
If User1 requests Role1, the request will be approved automatically.
No
User1 can approve the request of User3 for Role2.
No
User1 must provide justification to approve the request of User2 for Role1.
Yes
According to the Microsoft SC-300 study guide, Exam Ref SC-300, and Microsoft Entra Privileged Identity Management (PIM) documentation, role activation and assignment settings in Azure AD PIM determine who can activate roles, who can approve activations, and whether justification is required. Let's analyze each configuration step-by-step.
Setting
Value
Required justification on activation
No
Require approval to activate
Yes
Approvers
User1
Allow permanent eligible assignment
Yes
Allow permanent active assignment
Yes
Require justification on active assignment
Yes
Eligible Assignments: User1, User2
Setting
Value
Required justification on activation
Yes
Require approval to activate
No
Approvers
None
Allow permanent eligible assignment
No
Allow permanent active assignment
Yes
Require justification on active assignment
Yes
Eligible Assignments: User3
"If User1 requests Role1, the request will be approved automatically."
* Role1 requires approval to activate.
* The approver is User1, but a user cannot self-approve their own request in Azure AD PIM.
* Therefore, even though User1 is listed as an approver, the system does not automatically approve self- requests.
# Answer: No
"User1 can approve the request of User3 for Role2."
* Role2 does not require approval to activate (approval = No).
* User3 is the only eligible member for Role2 and can activate it directly.
* Hence, no approval action exists for User1.
# Answer: No
"User1 must provide justification to approve the request of User2 for Role1."
* Role1 requires approval to activate, and User1 is the approver.
* The assignment settings for Role1 state: Require justification on active assignment = Yes.
* This means when approving or activating, the approver (User1) must enter a justification before approval.
# Answer: Yes