Question

Your organization uses a role-assignable security group named SG-DBAdmins that is permanently assigned the Contributor role on a production SQL Azure subscription. Auditors require that membership in SG-DBAdmins be time-bound and require approval before it grants access, while keeping the group's underlying Azure role assignment unchanged. What should you configure?

Accepted Answer

Onboard SG-DBAdmins to Privileged Identity Management for Groups and assign users as eligible members with an activation approval requirement.

Answer

Create a PIM for Azure resources eligible assignment of the Contributor role directly to each user on the subscription.

Answer

Convert SG-DBAdmins to a dynamic membership group with a rule that includes only approved database administrators.

Answer

Create an access package in entitlement management that grants membership to SG-DBAdmins with an access request policy.