Question

Your company uses PIM for Azure resources. A team of developers needs to activate the Contributor role on demand, but only for a single resource group named rg-payments, not the entire subscription. Currently the subscription is onboarded to PIM and no eligible assignments exist for the developers. What should you do to grant time-bound, least-privilege access?

Accepted Answer

Create an eligible Contributor assignment for the developers scoped to the rg-payments resource group in PIM.

Answer

Create an active Contributor assignment for the developers scoped to the subscription in PIM.

Answer

Assign the developers the Contributor role directly on the subscription using Azure RBAC without PIM.

Answer

Create an eligible Owner assignment scoped to the rg-payments resource group so developers can self-manage access.