Question

Your organization uses Privileged Identity Management (PIM) for Microsoft Entra roles. Security leadership requires that when an engineer activates the Exchange Administrator role, activation must be approved by a designated approver, the engineer must provide a support ticket number, and the maximum activation duration must be limited to 4 hours. You are configuring the role settings in PIM. Which PIM configuration meets all three requirements with the least administrative effort?

Accepted Answer

Configure the Exchange Administrator role assignment settings to require approval to activate, require ticket information on activation, and set the maximum activation duration to 4 hours.

Answer

Create a Conditional Access policy targeting the Exchange Administrator role that requires MFA and a compliant device, and set an access review recurring every 4 hours.

Answer

Assign the role as permanent eligible, then create an access package in entitlement management with an approval workflow and a 4-hour lifecycle policy.

Answer

Configure the role activation settings to require Microsoft Entra multifactor authentication and justification, and use an Azure Automation runbook to remove the role after 4 hours.