A security engineer wants a user's elevated Global Administrator role in Microsoft Entra ID to be active only for a limited time window when actually needed, requiring justification and approval for each activation, rather than being permanently assigned. Which Entra ID feature is purpose-built for this?

• APrivileged Identity Management (PIM), which supports just-in-time, time-bound, approval-gated role activation
• BConditional Access alone
• CAzure Key Vault
• DAzure Policy