Question

Contoso uses a security group named SG-SQL-Admins that is assigned the Owner role on three production Azure SQL resource groups. Rather than granting these privileges permanently, the identity team wants members to request just-in-time membership in SG-SQL-Admins, with approval and a maximum active time of 4 hours, while keeping the underlying Azure RBAC assignment on the group unchanged. What must the team do first to enable this?

Accepted Answer

Onboard SG-SQL-Admins to PIM by bringing the group under Privileged Identity Management (enable it as a role-assignable/PIM-managed group), then configure eligible member assignments and activation settings.

Answer

Convert the Azure RBAC role assignment for each resource group to an eligible assignment in PIM for Azure resources and delete the group.

Answer

Create an access package in entitlement management that assigns SG-SQL-Admins membership with an approval policy and a 4-hour expiration.

Answer

Enable a recurring access review on SG-SQL-Admins so members are removed automatically after 4 hours.