Question

Your company uses Privileged Identity Management (PIM) for Azure resources. A DevOps engineer needs the Contributor role on a production resource group, but only when performing planned maintenance windows. Corporate policy requires that standing access be minimized and that any use of the role be time-bound and require justification at the moment of use. Which PIM assignment configuration should you apply?

Accepted Answer

Create an eligible assignment for the Contributor role so the engineer activates it when needed.

Answer

Create an active assignment for the Contributor role with a permanent end date.

Answer

Add the engineer to a security group that has a permanent active Contributor assignment.

Answer

Create an active assignment for the Contributor role with an expiration set 90 days out.