Question

You are a Microsoft Identity and Access Administrator. Your organization has 12 users with permanent active assignments to the User Administrator role in Microsoft Entra ID. Leadership requires that these users retain the ability to perform their duties but only activate the role when needed, with an approval and MFA requirement enforced on each activation. You onboard the role to Privileged Identity Management (PIM). What should you do to meet the requirement with the least administrative effort while preserving the ability for these users to keep working?

Accepted Answer

Convert the 12 permanent active assignments to eligible assignments in PIM, then configure the role settings to require approval and MFA on activation.

Answer

Remove the 12 users from the role and re-add them as permanent active assignments, then enable Conditional Access to require MFA.

Answer

Leave the assignments as permanent active and configure PIM role settings to require MFA and approval on activation.

Answer

Create an access review for the role and mark the 12 users as eligible when the review completes.