A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?
Trap 1: Require multi-factor authentication on activation.
Requiring multi-factor authentication (MFA) on activation adds a strong authentication check, but it does not impose any time-bound restriction on the role nor does it introduce an approval process. In fact, Azure AD PIM already enforces MFA by default for all role activations unless explicitly exempted, so configuring this alone does not address the stated requirements for time-bound and approval-based access. MFA is a valuable security control but is irrelevant to the specific compliance scenario described.
Trap 2: Require justification on activation.
Requiring a justification on activation captures an audit trail and enforces accountability, but it has no effect on how long the role remains active and does not add a separate approval step. A user could provide a justification and still receive unlimited activation duration if no maximum is configured, leaving the role permanently active. Therefore, justification only supports transparency and auditing, not the time-bound or approval requirements, so it is not the correct configurable setting for this scenario.
- A
Set the activation maximum duration to 8 hours.
Setting the activation maximum duration to 8 hours in Azure AD PIM enforces a strict time-bound on any privileged role activation. This ensures that a user cannot remain in the role indefinitely; after the configured duration, the role assignment automatically expires and reverts to eligible state. Since 8 hours is the maximum allowed activation duration for Azure AD roles, this directly satisfies the requirement that privileged access be temporary and bounded by a specific time limit.
- B
Enable approval workflow by adding the manager as an approver.
Enabling the approval workflow and configuring the user's manager as an approver requires every activation request to be explicitly reviewed and approved by that manager before the role becomes active. This satisfies the approval requirement by adding a mandatory human control point, ensuring that privileged access is granted on-demand only after proper authorization. The approver can evaluate the request context, including the provided justification, before granting access.
- C
Require multi-factor authentication on activation.
Why wrong: Requiring multi-factor authentication (MFA) on activation adds a strong authentication check, but it does not impose any time-bound restriction on the role nor does it introduce an approval process. In fact, Azure AD PIM already enforces MFA by default for all role activations unless explicitly exempted, so configuring this alone does not address the stated requirements for time-bound and approval-based access. MFA is a valuable security control but is irrelevant to the specific compliance scenario described.
- D
Require justification on activation.
Why wrong: Requiring a justification on activation captures an audit trail and enforces accountability, but it has no effect on how long the role remains active and does not add a separate approval step. A user could provide a justification and still receive unlimited activation duration if no maximum is configured, leaving the role permanently active. Therefore, justification only supports transparency and auditing, not the time-bound or approval requirements, so it is not the correct configurable setting for this scenario.