A night-harbor superintendent should become subscription Owner only while a lock is jammed, not for the entire month. Which PIM assignment type for that Azure resource role fits?
Select an answer to reveal the explanation.
Short Explanation
Eligible is the spare captain’s hat on the hook—you put it on when the lock jams, then hang it back up. Active Owner means the hat never leaves your head all month. JIT VM access is a different door entirely; it is not subscription Owner.
Full Explanation
In Microsoft Entra Privileged Identity Management for Azure resources, eligible assignments mean the principal can activate the role just in time, while active assignments are already effective. For a night-harbor superintendent who should be subscription Owner only while a lock is jammed, an eligible Owner assignment fits: rights appear after activation for a limited window instead of lasting the entire month as standing Owner.
An active Owner assignment fails the requirement because the superintendent would hold Owner continuously without requesting activation. A permanent Contributor assignment plus Azure Bastion fails by concept: Bastion brokers remote connectivity; it does not grant Owner-equivalent Azure RBAC, and permanent Contributor is neither Owner nor just-in-time. A JIT VM access request fails because just-in-time VM access unlocks management ports to a VM for a window—it does not grant subscription Owner rights.
Exam caveat: distinguish PIM eligible/active for Azure resource roles from JIT VM access in Defender for Cloud; both reduce standing exposure but solve different problems. Operational check: create eligible Owner for the superintendent, activate during a drill with MFA/justification as required, confirm Owner actions work during the window, and confirm access ends when activation expires.