Question

Contoso has a subscription containing production workloads. A small group of engineers currently hold permanent Owner role assignments so they can respond to incidents. The security team wants to eliminate standing administrative access, require approval and MFA before elevation, and automatically expire elevated access after each incident, while producing an audit trail of who activated privileged roles. Which solution should you recommend?

Accepted Answer

Configure Azure AD Privileged Identity Management (PIM) to make the Owner role eligible with just-in-time activation requiring approval and MFA

Answer

Create an Azure Policy that denies role assignments outside business hours and enable Activity Log alerts on role changes

Answer

Assign the engineers a custom RBAC role scoped to the subscription and configure Conditional Access to require MFA at sign-in

Answer

Use an Azure AD access review that runs weekly to remove Owner assignments that are no longer needed