Exam MS-102 topic 1 question 10 discussion

Yes, Yes, Yes ??

Yes No Yes Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multi-factor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers.

Y,Y,Y, and this is why, it's just asking if Group 2 admins can perform those tasking between that date range, and they can, whether they have to request the role to be made active or not, they have the required privileges to do so.

This question was in exam in March 17 2025

I think correct answers: Yes , Yes ,Yes

I don't see why it can't be YYY. If the admin request for a permission to activate the role, does it not make them capable to perform the task? The question itself is ambiguous as it didn't say the permission was denied or approved.

question doesn't say that PIM is enabled. So surely it's YYY?

For me the answer is correct. Admin 2 has to activate their role to be able to mange the Exchange online. Since it is not mentioned, I go with no.

Y,Y,Y, because if activate it, he is be able to Manage Exchange online

Question 2 is no because of Known Issues with role-assignable groups: "If an administrator role is assigned to a role-assignable group instead of individual users, members of the group will not be able to access Rules, Organization, or Public Folders in the new Exchange admin center. The workaround is to assign the role directly to users instead of the group." Thus Admin2 will not be able to fully manage Exchange Online. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/groups-concept#known-issues

Answer: YNY The type of the assignment - Eligible assignments require the member of the role to perform an action to use the role. Actions might include activation, or requesting approval from designated approvers. - Active assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role. The duration of the assignment, using start and end dates or permanent. For eligible assignments, the members can activate or requesting approval during the start and end dates. For active assignments, the members can use the assign role during this period of time. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

YNY for me - N only because User 2 would need to activate the role they are eligible for first (that is an important detail). It is an ambiguous question though..

Yes no Yes. The second is no. It's elegible, Admin 2 has to activate the role then he can manage Exchange Online. for put a yes, the answer should be "Admin 2, after activate his role, can manage exchange online?" -> yes.

You need "organization management" role in other manage Exchange . YNY

Here are my thoughts and explainations: Q: On July 15, 2023, admin 1 can reset the password of a user. A: Yes. Admin 1 is a member of Group 1, which has been assigned the User Administrator role actively from March 15, 2023, to August 15, 2023. This role permits password reset actions among others. Q: On June 20, 2023, admin 2 can manage Microsoft Exchange Online. A: Yes, but with a condition. Admin 2 is a member of Group 2, which has been assigned the Exchange Administrator role as eligible from June 15, 2023, to October 15, 2023. However, since the assignment type is "Eligible," admin 2 needs to activate the role to perform the Exchange Administrator tasks. Once activated, admin 2 can manage Microsoft Exchange Online. Q: On May 1, 2023, admin 3 can reset the password of a user. A: Yes. Admin 3 is a member of both Group 1 and Group 2. Since Group 1 has the User Administrator role assigned actively from March 15, 2023, to August 15, 2023, admin 3 can reset the password of a user during this period. Yes,Yes,Yes

I want to say YYY is likely correct, considering that Admin 2 has eligible assignment and the whole reason to assign someone as eligible to a role is to be able to grant that permission in the first place. So there is nothing in the shown settings that prevents Admin 2 from doing so, though we don't know if they will need to be approved for it or not.

I guess it should be Yes, No, Yes as it says in MS https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/groups-assign-member-owner Eligible assignment requires member or owner to perform an activation to use the role. Activations may also require providing a multi-factor authentication (MFA), providing a business justification, or requesting approval from designated approvers. Important For groups used for elevating into Azure AD roles, Microsoft recommends that you require an approval process for eligible member assignments. Assignments that can be activated without approval can leave you vulnerable to a security risk from another administrator with permission to reset an eligible user's passwords. Active assignments don't require the member to perform any activations to use the role. Members or owners assigned as active have the privileges assigned to the role at all times.