An automation account’s managed identity needs Contributor on a resource group so a nightly job can resize a scale set. Why should the security engineer avoid an eligible PIM assignment for that identity?
Select an answer to reveal the explanation.
Short Explanation
A managed identity is a robot—it cannot open the PIM portal, pass MFA, or type a business reason. Give the automation account an active Contributor assignment for that resource group, not an eligible hat it can never put on.
Full Explanation
PIM eligible Azure RBAC assignments assume a principal that can perform activation (typically a user), including MFA or justification when configured. Applications, service principals, and managed identities cannot complete those interactive activation steps, so they require active assignments for the permissions they need.