Question

A financial services company is designing privileged access for a new Azure DevOps platform team. Requirements: (1) engineers request elevated roles only when needed and receive approval-gated, time-bound activation; (2) external contractors get bundled access to multiple resources with an automatic expiration and periodic access reviews; (3) all privileged role activations require MFA and justification. Which design correctly maps Entra features to these requirements?

Accepted Answer

Use PIM for eligible Azure AD/Azure resource role activation with MFA and approval for engineers; use Entitlement Management access packages with expiration and access reviews for the contractor bundle.

Answer

Use Entitlement Management access packages for engineer role activation, and PIM eligible assignments for the contractor resource bundle with access reviews.

Answer

Assign all engineers and contractors permanent active roles, and rely on Conditional Access to enforce MFA at sign-in for both groups.

Answer

Use Conditional Access authentication contexts for engineers' role activation and Azure RBAC custom roles with group-based licensing for the contractor bundle.