An identity administrator wants every activation of the Privileged Role Administrator role in Microsoft Entra Privileged Identity Management to require the activating user to satisfy a phishing-resistant multi-factor challenge bound to a specific Conditional Access policy, rather than the generic multi-factor prompt PIM offers on its own. Which PIM activation setting links the activation to that policy?
- AEnable the require multi-factor authentication on activation setting, which automatically applies the strongest Conditional Access grant control available in the tenant
- BRequire Microsoft Entra Conditional Access authentication context on activation, then target a Conditional Access policy at that context with the phishing-resistant control Correct
- CConfigure a sign-in frequency Conditional Access policy targeting the Privileged Role Administrator role members and tighten the session interval
- DRequire approval to activate and add the phishing-resistant approver as a delegated reviewer who confirms the method during each raise
Why A is wrong: The built-in require multi-factor setting only triggers the generic prompt and does not invoke a specific Conditional Access policy, so it cannot enforce a chosen phishing-resistant control.
Why B is correct: Authentication context lets the activation invoke a Conditional Access policy, so the phishing-resistant grant control is enforced at the moment of the raise, which is exactly what binding to a specific policy requires.
Why C is wrong: Sign-in frequency forces reauthentication on a schedule but is not invoked by a PIM activation and cannot bind a particular grant control to the act of raising the role.
Why D is wrong: Approval gates who may raise the role but does not impose an authentication strength on the activating user, and an approver cannot enforce the activating user's authentication method.