Question

Your organization wants to reduce the number of administrators who hold permanent Global Administrator rights. The security team requires that admins activate elevated access only when needed, justify the activation, and have the access automatically expire after a set period. You have Microsoft Entra ID P2 licenses. What should you configure to meet these requirements?

Accepted Answer

Assign the Global Administrator role as an eligible assignment in Privileged Identity Management (PIM) with activation requiring justification and a time limit

Answer

Create an administrative unit and scope the Global Administrator role to it for each admin

Answer

Assign the Global Administrator role as a permanent active assignment and enable a Conditional Access policy requiring MFA

Answer

Add the admins to a role-assignable Microsoft 365 group that is permanently assigned the Global Administrator role