Exam MS-102 topic 1 question 61 discussion

1) 15 days. The user is Assigned the role in active state. The active assignment expires after 15 days, as shown in the config details. 2) the role can be made available to activation requests for 3 months. This is because the role assignment can be an Eligible assignment and an Eligible assignment is configured to expire after 3 months. Eligible assignments require themselves to be activated just in time by the assignee within the 3 month period. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user

A user that is assigned the Global Administrator role as active [will lose the role after 15 days]. You can make the Global Administrator role available to activation requests [for up to eight hours].

First Answer: Will lose the role after 15 days. From the setting: Expire active assignments after 15 days. Activation maximum duration is the amount of time that an activation "request remains active" before it expires (this is not the activation period for the role assignment). In other words, in this example, you can wait up to 8 hours for an activation request to be approved/denied (by the way, the max time is 24 hours). If there is no approval within this period, the activation "request" expires, and you have to submit a new request. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings?source=recommendations Second Answer: for up to three months - From the setting "Expire eligible assignments after 3 months."

1)A user that is assigned the Global Administrator role as active will lose the role after 15 days. 2)You can make the Global Administrator role available to activation requests for up to eight hours.

As I understand it The user can activate the role at any time, up to 3 months. Once the user sends the request the first time, the role becomes ACTIVE and can send activation requests up to a maximum of 15 days. After this time, he/she will not be able to activate the role anymore. In those 15 days, the user will be able to activate it for a maximum of 8 hours and after this period, the user will no longer have the role and must make another activation request. You can make activation requests up to 15 days. Each time the user sends a request, the role becomes ACTIVE. A user who is assigned the Global Administrator role as active (will lose the role after 15 days). You can make the Global Administrator role available for activation requests (for up to 8 hours).

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-configure-role-settings Activation maximum duration Use the Activation maximum duration slider to set the maximum time, in hours, that an activation request for a role assignment remains active before it expires. This value can be from 1 to 24 hours.

These are trick questions, but the answer lies in the Question. 1. assigned (Solution is under the assignment section) = Active Assignment will Expire (lose) after 15 days 2. Activation (Solution is under the activation section) = Maximium Activation duration 8 hours. I hope this clarify the question

my selection Box1) will lose the role after 15 days Box2) for upto 3 months

Given answer is correct, comments all look wrong imo.

poor wording because 1. the user will lose the role after 15 days, but they can have it activated every 15 days so both fits. 2. activation request last for 8 hours, but they can also request activations for the next 3 months 1. i would go with lose the role after 15 days because they would need privileged role admin to reactive it or have someone with that role do it. 2. i would go with for up to three months because its talk about how long the user is eligible to make request. to be the other way it should read available to activation request that last...

How I see it. 1. will lose the role after 15 days 2. for up to eight hours

Ici le point marquant c'est qu'il n'y a pas d'approbation vu qu'il est administrateur global, ainsi lorsque l'utilisateur active la mission il a 15 jours pour travailler avant que son activation ne s' expire après 15 jours pour que le l'utilisateur fasse une nouvelle demande d'activation et il est à noter qu'il a 3 mois d'éligibilité c'est à dire 3 mois pour exploiter le rôle d'administrateur global après ceci il perdra ce privilège. Réponses : 1) 15 jours 2) 3 mois

Correct

Hello Guys, according to the link below, 8 hours is just the required time for the admin to activate the role if a user requests it. For example: if User1 requests an admin role. the PIM admin has 8 hours to activate the role for User1. 8 hours after the requests of User1 if the admin doesn't activate the role for him, the request will expire and User1 has to request again. But if the admin activates the role for User1 within 8 hours, User1 will have 15 days to do his job. After 15 days he will lose the role. https://learn.microsoft.com/fr-fr/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings

Correct answers are: A user that is assigned the Global Admin role *as active*: will lose the role after 15 days You can make a Global Admin role available to *activation requests*: for up to eight hours. People often misunderstand the difference between Activation section and Assignment section. Keyword-"activation" is always the process of elevation from eligibility to active assignment, and is regulated via "Activation maximum duration" Keyword-"active" is always the "permanent active assignment", and is regulated by "Expire active assignment after"

TBH, I think the config is wrong, a PIM profile can be eligible or active but not both, so I don't know why we can see both options. In that case is eligible, so the role, once is active manually, will be active for 8 hours, afterwards, he/she will lose the rol (question A). This kind of activation will be available for 3 months (question B)

Atrocious wording. Depending on how you interpret "lose" 3 options in 1st answer can be valid: will lose the role after 8 hours can reactivate the role every 8 hours will lose the role after 15 days 2nd answer is correct: 3 months