Question

Your organization uses Microsoft Entra Privileged Identity Management (PIM). A senior administrator needs standing access to a role for the next two weeks while covering another team, and does not want to activate the role each day. However, most other admins should only get the role when they explicitly request and justify it. As the identity administrator, how should you configure these two assignment scenarios in PIM?

Accepted Answer

Give the senior administrator an active assignment with an expiration date, and give the other admins eligible assignments.

Answer

Give the senior administrator an eligible assignment, and give the other admins active assignments.

Answer

Give all administrators permanent active assignments and rely on audit logs to track usage.

Answer

Give all administrators eligible assignments and disable activation approval to speed up access.