nerdexam
Microsoft

AZ-500 · Question #361

You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM). A PIM user that is assigned the User Access Administrator role reports receiving an…

The correct answer is B. User Access Administrator. The PIM service principal requires appropriate permissions to manage role assignments within a subscription, and an authorization error indicates insufficient permissions. To resolve this with least privilege, the PIM service principal should be granted the User Access…

Submitted by amina.ke· Mar 6, 2026Secure identity and access

Question

You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM). A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments. You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege. Which role should you assign to the PIM service principle?

Options

  • AContributor
  • BUser Access Administrator
  • CManaged Application Operator
  • DResource Policy Contributor

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    77% (27)
  • C
    3% (1)
  • D
    14% (5)

Why each option

The PIM service principal requires appropriate permissions to manage role assignments within a subscription, and an authorization error indicates insufficient permissions. To resolve this with least privilege, the PIM service principal should be granted the User Access Administrator role.

AContributor

The Contributor role grants full access to manage all resources but does not include the ability to assign roles in Azure RBAC, making it insufficient for managing access and exceeding least privilege if other permissions are not needed.

BUser Access AdministratorCorrect

The Azure AD PIM service principal needs permissions at the subscription level to manage role assignments effectively. The User Access Administrator role is specifically designed to manage user access to Azure resources, including the ability to view all role assignments and assign roles, which aligns with the operations PIM performs, adhering to the principle of least privilege.

CManaged Application Operator

The Managed Application Operator role is specific to managing managed applications and does not grant permissions for managing Azure RBAC role assignments across a subscription.

DResource Policy Contributor

The Resource Policy Contributor role is for managing resource policies (Azure Policy) and does not provide permissions to view or assign Azure RBAC roles.

Concept tested: Azure PIM service principal permissions for role management

Source: https://learn.microsoft.com/azure/active-directory/privileged-identity-management/subscription-owners-ready-pima#grant-the-privileged-identity-management-service-access-to-your-azure-resources

Topics

#Privileged Identity Management#service principal#role assignment#least privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice