Question

Your organization wants to reduce standing administrative access in Microsoft Entra ID. Several engineers need the Contributor role on a production subscription, but only occasionally during scheduled maintenance windows. You must ensure these engineers do not hold the permissions continuously, and instead must request and activate the role when needed, subject to approval. Which approach should you implement?

Accepted Answer

Assign the Contributor role as an eligible assignment using Microsoft Entra Privileged Identity Management (PIM)

Answer

Assign the Contributor role as a permanent (active) role assignment at the subscription scope

Answer

Create a custom RBAC role with reduced actions and assign it permanently to the engineers

Answer

Add the engineers to a dynamic membership group that is granted the Contributor role