Before you start: exam facts
This course is independent of Microsoft and cannot promise you a pass. Microsoft publishes the SC-500 study guide for free on Microsoft Learn. This course follows its bullets but does not reproduce the guide. Microsoft states that you have 120 minutes for the exam, and you need a score of 700 or greater to pass. SC-500 is a new exam, and Microsoft says no Practice Assessment is available yet. Anything about question weighting below bullet level is unconfirmed.
This level covers the first bullet under Secure access to resources by using Microsoft Entra ID: Implement and configure Privileged Identity Management (PIM).
What PIM does
PIM is part of Microsoft Entra ID Governance. It gives you just-in-time privileged access in place of standing access. It needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licences. PIM manages two kinds of role:
- Microsoft Entra roles: directory roles such as Global Administrator, User Administrator and Security Administrator.
- Azure resource roles: Azure RBAC roles such as Owner, Contributor and User Access Administrator, at management group, subscription, resource group or resource scope.
You find both in the Microsoft Entra admin center under ID Governance > Privileged Identity Management.
Assignment types: eligible, active and time-bound
Every PIM assignment has two properties:
- Type
- Eligible: the user holds no permissions until they activate the role. To activate, they meet the role's conditions, such as MFA, justification or approval.
- Active: the user has the permissions straight away and does not need to activate.
- Duration
- Permanent: no end date.
- Time-bound: a start date and an end date.
An activation is a separate, short time window inside an eligible assignment. For example, a user can be eligible for six months and activate for four hours at a time.
Analogy: an eligible assignment is like holding a key card for the server room that has to be validated each time you use it. An active assignment is a door that is propped open.
Task 1: Set role settings for a Microsoft Entra role
Role settings, also called PIM policies, apply per role, and every assignment of that role follows them. You need at least the Privileged Role Administrator role.
- Go to ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles.
- Select the role, for example Exchange Administrator.
- Select Role settings > Edit.
- On the Activation tab, configure:
- Activation maximum duration (hours): a slider from 1 to 24 hours.
- On activation, require: either Azure MFA or Microsoft Entra Conditional Access authentication context. Conditional Access is covered in Level 3.
- Require justification on activation.
- Require ticket information on activation. This field is for information only, and PIM does not check it against any ticketing system.
- Require approval to activate: select approvers. Microsoft recommends at least two, and approvers do not need any role themselves.
- On the Assignment tab, choose:
- Allow permanent eligible assignment, or Expire eligible assignment after a set period.
- Allow permanent active assignment, or Expire active assignment after a set period.
- Require Azure Multi-Factor Authentication on active assignment and Require justification on active assignment. These apply to the administrator who creates an active assignment.
- On the Notification tab, set who receives emails. You can choose critical emails only.
- Select Update.
Lockout warning: if approval is required and you name no approvers, active Privileged Role Administrators and Global Administrators become the default approvers. If all of them are eligible and none are active, you lock yourself out of the tenant. Keep emergency access accounts and name specific approvers.
Task 2: Turn a permanent assignment into an eligible one
Scenario: Priya has a permanent active Exchange Administrator assignment. You want her to be eligible, with approval and a 4-hour activation limit.
- Configure the role settings first (Task 1): set Require approval to activate with two named approvers, and set Activation maximum duration to 4 hours.
- Open the role and select Add assignments.
- Select Priya, then set Assignment type = Eligible.
- Choose a duration. A time-bound assignment, for example 6 months, is the least-privilege choice.
- Select Assign.
- On the Active assignments tab, remove Priya's old permanent active assignment.
- Check the result: Priya now appears only under Eligible assignments.
The order matters. If you remove the active assignment before the eligible one exists, Priya loses access in between.
Task 3: Set role settings for an Azure resource role
- Go to Privileged Identity Management > Azure resources.
- Choose a management group or subscription, then drill down to resource groups or resources if needed.
- Select the resource, then select Settings.
- Select the role, for example Contributor, and select Edit.
- Set the same Activation, Assignment and Notification options as in Task 1, then select Update.
How the two differ
| Point | Microsoft Entra roles | Azure resource roles |
|---|---|---|
| Scope of settings | Per role, across the whole tenant | Per role and per resource |
| Inheritance | Not applicable | Settings at subscription level are not inherited by resource groups |
| Who manages settings | At least Privileged Role Administrator | Owner or User Access Administrator of the resource |
| Default approvers | Privileged Role Administrators and Global Administrators | None: you must select at least one |
Task 4: Run an access review of privileged roles
- Go to PIM > Microsoft Entra roles (or Azure resources, then select the subscription) > Access reviews > New.
- Give the review a name, then set the Start date and Frequency: one time, weekly, monthly, quarterly, semi-annually or annually.
- Set the Users scope: users and groups (or users), or service principals.
- Choose the roles to review. Each role you select creates a separate review.
- Set the Assignment type: eligible only, active only, or all active and eligible.
- Choose Reviewers: selected users, members (self), or manager.
- Under Upon completion settings, set Auto apply results to resource to Enable, and set If reviewers don't respond to No change, Remove access, Approve access or Take recommendations.
- Turn on Show recommendations. These are based on sign-in activity over the last 30 days.
Choosing an assignment type
- Regular admin who needs the role occasionally: eligible, time-bound, with MFA and justification required.
- Contractor on a 3-month project: eligible, time-bound, ending when the contract ends, with approval required.
- Emergency access (break-glass) account: permanent active, kept out of approval flows.
- Short supervised task with no time for activation: active, time-bound, ideally for hours or days.
What the exam asks about this
Expect scenario questions that test whether you can:
- Pick eligible over active, and time-bound over permanent.
- Name the setting that meets a requirement, for example approval, justification or maximum duration.
- Spot Azure resource role differences: settings apply per resource and are not inherited, Owner or User Access Administrator manages them, and there are no default approvers.
- Set up access reviews with auto apply.
Distractors often swap activation duration with assignment duration. Some also suggest the ticket field is validated, which it is not.
Key takeaways
- Eligible means you activate on demand; active means you have the permissions now. Both can be permanent or time-bound.
- Activation maximum duration ranges from 1 to 24 hours.
- Entra role settings apply per role. Azure resource role settings apply per role and per resource, and are not inherited.
- Requiring approval with no approvers named can lock you out of the tenant if no administrators are active. Keep break-glass accounts.
- Access reviews clean up stale privilege. Turn on Auto apply results to resource.