Question

Your organization uses Privileged Identity Management (PIM) for the Global Administrator Entra role. The security team requires that every time this role is activated, a dedicated shared mailbox (secops-alerts@contoso.com) receives an email notification in addition to the default recipients, without disabling any existing notifications. What should you configure?

Accepted Answer

Edit the role settings for Global Administrator in PIM and add the shared mailbox to the 'Notifications' section for 'Notify when members activate the role'.

Answer

Create a Conditional Access policy scoped to the Global Administrator role that sends an email when the role is used.

Answer

Create an access review for the Global Administrator role and set the shared mailbox as the reviewer.

Answer

Assign the shared mailbox the User Administrator role so it appears in the default PIM notification distribution.