Lock operators already signed in with Windows Hello, so requiring MFA on PIM activation never prompts them. How can the engineer enforce a stronger check during Azure resource role activation?
Select an answer to reveal the explanation.
Short Explanation
If Hello already satisfied MFA at sign-in, the plain PIM MFA checkbox is a bouncer who waves through anyone already stamped. Hook activation to a Conditional Access authentication context that demands a tougher grant—like a compliant device—when they grab the Azure role.
Full Explanation
PIM can require Conditional Access authentication context on activation for Azure resource roles, which re-evaluates a Conditional Access policy at activation time. That pattern addresses cases where prior MFA satisfaction means a simple MFA checkbox never prompts. It is distinct from ID Protection user-risk policies and is not a Security Copilot feature.