You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM). You need to identify users that are eligible for the Cloud Application Administrator role. Which blade in the…

Question

Options

• AAzure resources
• BPrivileged access groups
• CReview access
• DAzure AD roles

• A
  9% (3)
• B
  75% (24)
• C
  3% (1)
• D
  13% (4)

Explanation

Explanation

Wait - there's an issue with the stated correct answer. The actual correct answer should be D. Azure AD roles, not B. The Cloud Application Administrator is an Azure Active Directory role, and in PIM, Azure AD roles (such as Global Administrator, Cloud Application Administrator, etc.) are managed under the Azure AD roles blade, which allows you to view eligible, active, and assigned users for those roles.

Why the other options are wrong:

• A. Azure resources is used to manage PIM for Azure RBAC roles (e.g., Owner, Contributor) scoped to subscriptions, resource groups, or resources - not Azure AD directory roles.
• B. Privileged access groups is used to manage membership and ownership eligibility for specific Azure AD groups, not for built-in Azure AD roles like Cloud Application Administrator.
• C. Review access (Access reviews) is used to periodically audit and certify role assignments, not to identify which users are eligible for a role.

Memory Tip: Think of it this way - if the role ends in "Administrator" and is a built-in Azure AD directory role, it lives under Azure AD roles in PIM. If it's a resource-level permission (like managing a VM), it's under Azure resources.

The answer key provided (B) appears to be incorrect - flag this question if encountered on a practice exam.

No community discussion yet for this question.