Microsoft Azure Security Engineer Associate AZ-500 Practice Question

To onboard an Azure subscription into PIM, the account must be able to create Azure RBAC role assignments on that resource and hold an Entra directory role that can manage PIM. The Microsoft.Authorization/roleAssignments/write permission is provided by the Owner (or User Access Administrator) role on the subscription. The ability to enable PIM is provided by the Privileged Role Administrator (or Global/Security Administrator) directory role. Granting both Owner on the subscription and Privileged Role Administrator in Microsoft Entra ID satisfies the requirements with the minimum necessary privileges. Granting only one of these roles, or assigning Global Administrator alone, would not provide the full set of permissions required to onboard the subscription.