Question

A financial services company must comply with an audit requirement stating that no administrator may hold standing Global Administrator or Privileged Role Administrator rights, and every elevation to these roles must require documented sign-off by a manager before access is granted. The security team also wants each elevation to automatically expire and generate an audit trail. Which solution should you recommend?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to make the roles eligible, requiring approval by a designated approver and time-bound activation for each elevation.

Answer

Assign the privileged roles permanently to the administrators and configure an Azure AD access review to recertify membership every 30 days.

Answer

Create a Conditional Access policy that requires MFA and a compliant device before the administrators can sign in with their privileged roles.

Answer

Place the administrators in a dynamic security group and use an Azure Policy initiative to audit whether the group membership complies with the requirement.