Question

Your organization uses Privileged Identity Management (PIM) for Microsoft Entra roles. Security policy requires that when an administrator activates the User Administrator role, the activation must automatically expire after 4 hours, and every activation must include a justification and be approved by a designated approver. You have already made all eligible assignments. What should you configure to enforce all three requirements with the least administrative effort?

Accepted Answer

Edit the PIM role settings (assignment settings) for the User Administrator role and set the maximum activation duration, require justification on activation, and require approval to activate.

Answer

Create a Conditional Access policy targeting the User Administrator role with a sign-in frequency of 4 hours and require MFA.

Answer

Configure an access review for the User Administrator role that recurs every 4 hours and requires approver sign-off.

Answer

Convert the eligible assignments to active assignments with a 4-hour expiration and add the role to an approval-required access package.