Cloud · Microsoft Azure · Certifications
AZ-500: Role required to implement PIM for Entra roles
Select one answer. Your result and the explanation will appear immediately.
Question 21
Your organization has recently created an Azure subscription and needs to enable Azure AD Privileged Identity Management (PIM) for managing privileged roles. Which role should you assign to a user to ensure they have the necessary permissions to implement and manage PIM settings for the tenant?
Correct answer: Global Administrator
A Global Administrator has the tenant-wide permissions required for the initial setup and management of Privileged Identity Management for Microsoft Entra roles. The other listed roles have focused security, compliance, or password-management duties but do not provide the full PIM configuration authority.
Exam clue: The question asks about implementing and managing PIM settings for the tenant, not simply monitoring security or resetting passwords.
Remember: Use Global Administrator for initial PIM setup for Microsoft Entra roles. After setup, delegate PIM administration using narrower roles where appropriate.