A security team wants each global administrator to hold their elevated role only for the short period they actively need it, with an approval and an audit trail every time the role is switched on, rather than being permanently assigned. Which Microsoft Entra ID capability meets this requirement?
- AIdentity Secure Score, which grades the tenant and grants the role temporarily once the score threshold is met
- BA conditional access policy that grants the administrator role for a limited session after multifactor authentication
- CSingle sign-on, which issues the administrator role automatically when the user authenticates once
- DPrivileged Identity Management, which makes the role eligible and requires just-in-time activation with approval and auditing Correct
Why A is wrong: Identity Secure Score reports on security posture and recommends improvements, but it does not assign, time-box, or approve administrative roles.
Why B is wrong: Conditional access can require multifactor authentication before access, but it does not assign directory roles or provide just-in-time role activation with approvals.
Why C is wrong: Single sign-on streamlines authentication across applications and has no ability to grant, time-box, or approve privileged role activation.
Why D is correct: Privileged Identity Management provides eligible assignments, time-bound just-in-time activation, optional approval, and an audit trail, which is precisely the described need.