Microsoft Azure Solutions Architect Expert AZ-305 Practice Question

Azure AD Privileged Identity Management (PIM) lets you make Azure role assignments eligible, define start and end dates, and require approval each time the role is activated. By creating a custom RBAC role that contains only the permission Microsoft.Compute/virtualMachines/restart/action and assigning it as an eligible role through PIM at the subscription scope, the operations team gains just the ability to restart any VM. The assignment can be set to expire after three months, and a manager can be configured as the approver for each activation. The built-in Virtual Machine Contributor role includes additional permissions such as create and delete, violating least-privilege. Resource locks govern resource state, not user permissions, and managed identities are intended for application authentication rather than external operators.