Question

A financial services company is designing privileged access for its Azure environment. Global Administrator and other Entra ID directory roles are currently assigned permanently to eight staff members. Auditors require that standing highly privileged access be eliminated, activations be time-bound and approval-gated, and that a permanent role assignment remains only for emergency use. The company already licenses Entra ID P2. Which design best meets the auditor requirements while minimizing standing privilege?

Accepted Answer

Convert the directory role assignments to PIM eligible assignments requiring approval and MFA on activation, and configure two break-glass accounts with permanent Global Administrator assignments excluded from Conditional Access.

Answer

Keep the eight permanent Global Administrator assignments but enforce a Conditional Access policy requiring MFA and a compliant device for all administrative sign-ins.

Answer

Move all eight administrators into an Entra ID access package with quarterly access reviews and assign the Global Administrator role through entitlement management.

Answer

Create a single PIM eligible assignment shared by all administrators using a group-based role and require a justification note on activation.